Malicious Ruby Gem 'strutil-core' Steals 51 Types of Credentials, Plants Backdoors in AI Tools
A malicious Ruby gem, strutil-core, disguised as a string manipulation tool, was discovered on RubyGems, acting as a credential-stealing worm and planting backdoors in AI coding tools.
A newly discovered malicious Ruby gem, named strutil-core, has been found on the RubyGems repository, posing a significant threat to developers by acting as a credential-stealing worm and attempting to install backdoors within AI coding tools. The gem, disguised as a legitimate string manipulation utility, was active for approximately five hours before being removed by RubyGems. This incident highlights the increasing sophistication and speed at which attackers are targeting developer environments, including laptops, build servers, and AI-powered coding assistants.
The malicious gem, version 1.0.1, was published by an account named 'jamnajiea' and contained a substantial payload. Upon installation, it executed a native extension script, extconf.rb, which downloaded and ran a bundled payload. This payload was designed to exfiltrate sensitive data from 51 different types of credential stores. These included cloud keys for services like AWS, package registry tokens for npm and PyPI, SSH keys, Kubernetes and Vault secrets, password manager data, and cryptocurrency wallet information. The stolen data was encrypted and sent to a command-and-control server at paleasbest[.]top, with fallback options to GitHub or GitLab repositories if the primary server was unavailable.
Researchers at Socket.dev flagged the malicious file within 70 seconds of its publication. While no public projects were found to depend on the gem and no confirmed victims have been identified, the potential for widespread compromise is significant. The malware employed a sophisticated technique to steal secrets directly from the process memory of GitHub Actions runners, mirroring tactics seen in previous attacks like the tj-actions compromise. It also attempted to tamper with security agents such as StepSecurity Harden-Runner, though these attempts were reportedly unsuccessful.
The threat extended beyond simple credential theft, with strutil-core actively seeking to compromise AI coding tools. It searched for configuration files used by popular AI assistants, such as settings.json, mcp.json, and .aider.conf.yml. The malware then attempted to inject malicious configurations, including a fake MCP server named 'workspace-tools' and SessionStart hooks, which could execute arbitrary code when a coding session began. This functionality could potentially re-infect systems or spread the malware further through AI tools that trust local repository configurations.
For persistence, the worm installed a Python backdoor, sync.py, which periodically checked public GitHub commits for a specific marker. Upon finding the marker, it would download and execute a script from a hidden link within the commit message, provided the script was digitally signed by the attacker. This mechanism allowed for remote code execution and ongoing control over compromised systems.
Perhaps the most alarming feature of the strutil-core gem was its destructive wiper capability. If the malware obtained a stolen GitHub token, it would install a monitor called 'net-health-checker'. This monitor would periodically test the token's validity. If GitHub responded with a 401 or 403 error, indicating the token had been revoked, the monitor would execute a command to delete the user's entire home directory. This effectively turned the act of revoking a compromised token into a trigger for data destruction.
Socket.dev has linked this build to the testmetest worm, which is part of the Miasma family and reportedly originated from the public Shai-Hulud toolkit. While shared code does not definitively prove a single operator, it indicates a connection to a broader campaign targeting developers. The malware also included routines to republish infected packages to other repositories and spread via SSH, though these were not observed to be successful in this instance. The malware also exhibited geographic restrictions, skipping systems with Russian, Ukrainian, or Belarusian language settings.
Security experts advise that any system that installed strutil-core 1.0.1 should be treated as fully compromised. Immediate steps include isolating the host, stopping and removing the persistence mechanisms (net-health-checker and pkg-runtime), revoking the GitHub token, rotating all credentials from a clean device, and rebuilding the compromised host. Developers should also meticulously check Gemfile.lock files, CI caches, and container images for any signs of compromise and remove any unknown 'workspace-tools' entries from their AI tool settings.