A Ruby package that advertised itself as a harmless set of string helpers was in fact carrying a credential-stealing worm that runs the moment it is installed, researchers at Socket reported on 6 November 2026. The package, strutil-core version 1.0.1, is a new build of the testmetest worm, part of the Miasma family that grew out of the publicly released Shai-Hulud toolkit.

The RubyGems account jamnajiea published a clean version 1.0.0 on 1 November 2026 and pushed the malicious 1.0.1 less than two hours later. Socket’s AI Scanner flagged the payload 70 seconds after publication, at 04:06:14 UTC, and RubyGems removed both versions about five hours later, by 09:13 UTC. Socket found no public projects that depended on the gem and has confirmed no victims or downstream infections from it, a point the researchers stress repeatedly: the danger here is in what the code can do, not in a confirmed breach count.

The trick is in the installer. The gem declares a native extension, and its setup script, extconf.rb, contains no build logic at all. On Linux and macOS it downloads the Bun JavaScript runtime from Bun’s official releases and runs a bundled 5.48 MB JavaScript file during installation. No application ever has to load the gem: running gem install or a bundle install that resolves to it is enough, and the installation then finishes without errors.

Once running, the payload reads credential files and environment variables for cloud providers, package registries, Git hosts, SSH, Docker, Kubernetes, Vault, password managers, operating system keychains, cryptocurrency wallets and AI coding tools. A sandbox run by Bitbison recorded reads from 51 credential stores, including AWS credentials, npm and PyPI configuration files, and the credential files of Claude and Codex. With AWS credentials it enumerates Secrets Manager secrets and systems parameters across 17 regions. Stolen material is encrypted and sent to paleasbest.top, with GitHub and GitLab as fallbacks.

The most unusual part of the payload is how it targets the AI coding tools developers now rely on. It searches the home directory for configuration files belonging to Claude, Cursor, Gemini, Codex, Aider and Visual Studio Code, adds a model-context-protocol server called workspace-tools that runs the payload, and adds session-start hooks. Using stolen Git credentials it can commit the same poisoned configuration into repositories, including a generated AGENTS.md file that instructs coding agents to run a setup script before their first command. Opening an affected repository in an AI coding tool or VS Code can therefore re-run the worm, depending on that tool’s workspace trust settings.

The worm also installs a Python backdoor that checks public GitHub commits once an hour for a marker string and runs scripts from signed links it finds there, and a background monitor with a harsher purpose: if a stolen GitHub token starts returning 401 or 403 errors, suggesting it has been revoked, the monitor deletes the user’s home directory. Socket’s analysis of the code shows these behaviours, but they come from static analysis and sandbox runs, not from activity observed on victim systems.

Socket also found republishing routines for npm and PyPI, code to harvest JFrog Artifactory credentials, a fake CodeQL workflow that uploads secrets as an artifact, and SSH spreading code that enumerates hosts from a user’s known-hosts file. None of these downstream infections has been confirmed. The researchers note the gem itself appears to be the output of the worm’s own RubyGems injection module: its installer matches a template from the June 2026 Miasma payload almost line for line, and the library inside still declares version 1.0.0, because the injector changes the package version without editing the original source.

Developers should check Gemfile.lock files, CI caches and container images for strutil-core, and treat any machine that installed version 1.0.1 as compromised: uninstalling the gem does not undo the infection, because the payload writes outside the gem directory. Any credentials reachable from that machine should be rotated, and AI coding tool configurations should be inspected for the workspace-tools server and unexpected session hooks.