The Register
@TheRegister
Too big to spot? An npm worm campaign planted malicious payloads in 42 GitHub repos, using oversized files to evade code search and routine API checks.
Rubygems
Security incidents tagged Rubygems. Newest first.
2 Rubygems incidents in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 2
- Live
- 2
- Patched
- 1
- Days without an incident
- 0
- Longest quiet run: 66 days (Jul 24–Sep 27)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- Patched
Malicious Ruby gem strutil-core delivers testmetest/Shai-Hulud-descendant worm
Socket Threat Research (Nov 6 2026) analyzed strutil-core 1.0.1 on RubyGems, published by account jamnajiea: a clean 1.0.0 on Nov 1 was followed less than two hours later by malicious 1.0.1. During gem install, ext/strutil-core/extconf.rb downloads Bun and runs a 5.48 MB credential-stealing worm (testmetest / Miasma lineage descended from the public Shai-Hulud toolkit). The worm steals cloud/CI/registry/SSH/AI-tool/wallet credentials, exfiltrates to paleasbest.top (GitHub/GitLab fallbacks), can republish to RubyGems/npm/PyPI, poisons AI coding tool configs, and can wipe the home directory if a stolen GitHub token returns 401/403. Socket flagged it 70 seconds after publication; RubyGems removed both versions about five hours later. No public dependents or confirmed victims found. Related PyPI sibling pystr-codec used the same collection endpoint. See also the npm-focused testmetest incident.
RubyGems package strutil-core (related: PyPI pystr-codec; lineage shared with npm testmetest worm)Since Nov 1, 2026
Show 1 older incident1 older incident
July 2026 1
- HighPartly patched
testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloads
JFrog found that the testmetest npm worm campaign (a Shai-Hulud-descendant credential stealer that SafeDep first documented on Oct 22 2026) had already armed 42 GitHub repositories across 11 legitimate owners. Planted Claude, Gemini, Cursor and VS Code hooks run a .github/init.js wrapper of 12.9 to 13.7 MB, too big for GitHub code search and the contents API to see, that decodes to an npm publisher abusing GitHub Actions OIDC trusted publishing. Remove the malicious testmetest and @iobandamwer packages, treat hosts that installed them as compromised, remove the net-health-checker and pkg-runtime persistence before revoking tokens (the worm wipes ~/ on revocation), and audit repos for the hook files.
npm *-testmetest and @iobandamwer packages, hijacked GitHub repositoriesSince Jul 23, 2026
Posts 3
- testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloads
- testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloads
JFrog Security@JFrogSecurity🚨 testmetest goes beyond npm. JFrog Security Research identified 42 armed GitHub repositories across 11 legitimate owners hiding an npm publisher, plus a new native addon that decrypts its payload at runtime and stays dormant in CI, sandboxes, and analysis tools. The campaign
- testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloads
SafeDep@safedepio⚠️ Someone is testing a new Miasma-family npm worm in the open ("*-testmetest" packages). Once installed it steals your keys, cloud & AI creds, republishes your packages, backdoors your repos via Claude/Cursor configs, and wipes ~/ if you revoke the stolen GitHub token. Read:
