Malicious Ruby Gem Steals 51 Types of Credentials and Plants Backdoors in AI Coding Tools

A fake Ruby package called strutil-core looked like a harmless text helper. In fact, it ran a credential-stealing worm the moment a developer installed it.

The worm also wrote backdoors into the settings of AI coding tools. It could even delete a victim’s home folder if they tried to cancel a stolen GitHub token.

The gem was live on RubyGems for only about five hours. Even so, it shows how quickly attackers are moving toward developer laptops, build servers and the AI assistants that now sit on them.

Version 1.0.0 went up on November 1, 2026 from an account named jamnajiea, and it was clean. Less than two hours later the same account pushed version 1.0.1, which carried a 5.48 MB payload.

A sandbox run recorded reads from 51 credential stores, including AWS, npm, PyPI, Docker, Kubernetes, Claude and Codex files. This detail gave the story its headline number.

Researchers at Socket.dev noted that their AI scanner flagged the file 70 seconds after it was published. They found no public projects that depended on the gem.

They also have not confirmed any victims, and they stress that download counters do not show how many people were infected. RubyGems removed both versions within hours.

Malicious Ruby Gem

The gem described itself as “lightweight string manipulation helpers.” In reality, its Ruby code did only one small job. The danger sat in a native extension script named extconf.rb.

RubyGems runs this file during installation, so nobody has to load the gem in an app for the attack to start. On Linux and macOS, the script downloads the Bun JavaScript runtime and quietly runs the bundled payload.

The theft goes well beyond a few password files. The worm looks for cloud keys, package registry tokens, SSH keys, Kubernetes and Vault secrets, password manager data and crypto wallets.

With AWS keys, it reads Secrets Manager and SSM values across 17 regions. The stolen data is encrypted and sent to paleasbest[.]top. If that fails, the worm creates a public GitHub repository, described as “project-utils,” or falls back to GitLab.

On GitHub Actions runners, the payload also reads secrets straight from process memory, using the same trick seen in the 2025 tj-actions compromise.

It even tries to tamper with the StepSecurity Harden-Runner security agent, though StepSecurity says those attempts fail.

Developers who followed an earlier malicious RubyGems campaign targeting developers will see the same goal here: grab keys from the machines that build and ship software.

The code is also built to spread. It contains routines to republish infected packages to RubyGems, npm and PyPI, and to move through SSH. Socket confirmed these routines exist but saw no successful spread from this gem.

The malware skips systems with Russian, Ukrainian, Belarusian and several other regional language settings. It also leaves a trail of odd file names, such as a systemd service called pkg-runtime.

Backdoors Planted in AI Coding Tools

The second half of the story is the AI angle. The worm searches the home folder for settings files used by AI coding tools, such as settings.json, mcp.json and .aider.conf.yml.

It adds a fake MCP server named workspace-tools that runs the malware with Node. It also adds SessionStart hooks, which run code whenever a coding session opens.

If the worm finds working Git credentials, it pushes the same trick into repositories. It writes files such as .claude/settings.json, .cursor/mcp.json, CLAUDE.md, AGENTS.md and a VS Code task that runs when a folder opens.

The generated AGENTS.md even tells coding agents to run a setup script before their first command. So a developer who simply opens an infected repo in an AI tool may start the worm again, depending on that tool’s trust settings.

This fits a wider pattern. Attackers have already used a fake Gemini npm package to reach folders used by Cursor, Claude and other AI tools.

More recently, a malicious Claude Code extension in the Cursor marketplace planted an SSH key on developer machines.cybersecuritynews+1

For persistence, the worm installs a Python backdoor, sync.py. Every hour it checks public GitHub commits for a secret marker, msync-3f7a.

It reads a hidden link from the commit message and runs the script found there, but only if the link carries the attacker’s digital signature.

The nastiest piece is a wiper. When the worm steals a GitHub token, it installs a monitor called net-health-checker. Every 45 seconds, the monitor tests the token.

If GitHub answers with a 401 or 403 error, it runs a command that deletes the user’s home folder. In other words, revoking the token, the usual first response step, triggers the damage.

Socket links this build to the testmetest worm, part of the Miasma family that grew out of the public Shai-Hulud toolkit. The sync.py file is identical to the testmetest version.

the Shai-Hulud source has been public since May 2026, shared code does not prove one operator is behind every copy. This fits the pattern in recent supply chain attacks on developers.socket

Anyone who installed strutil-core 1.0.1 should treat the machine and every reachable credential as compromised. Isolate the host first. Then stop and remove net-health-checker and pkg-runtime before revoking the GitHub token.

Rotate all keys from a clean device and rebuild the host. Developers should also check Gemfile.lock files, CI caches and container images, and remove unknown workspace-tools entries from their AI tool settings.

Indicators of compromise (IoCs):-

Type	Indicator
Malicious package	strutil-core (version 1.0.1)
RubyGems account	jamnajiea
Gemspec author	Mark Tillman
Gemspec homepage	github.com/marktillman/strutil-core (nonexistent repository)
Domain	paleasbest[.]top
URL	hxxps://paleasbest[.]top/v1/api
SHA-256, strutil-core-1.0.1.gem	3b3f6e1bde0b28b015030a81a6d805b5b5306dc3f021e1102123971cfd83acc0
SHA-256, ext/strutil-core/index.js	306c1deec402e8b4a6478e7f0fe02194bcd224d37d8fc6ba61ad1951e8abd7a9
SHA-256, ext/strutil-core/extconf.rb	c5264f3b9cf2f95c83a70b7dd7430aab8abc262b853dbbcd5386c3a8a9c74769
SHA-256, strutil_core.rb	66c1c6b6b2c47e96fa5fd328338b939e1360511ab5eb2dda6d9112f592259d6b
SHA-256, embedded sync.py	c7ef186aa59b67d9b198a14f6dc8aaee6dd86510ac7c37d28f65d310cd846411
SHA-256, net-health-checker installer	e29a5319888319b51345ab8e3e009938ee5c2b9ae5d6bdd053f4f44c98f309d3
SHA-256, node_win.napi.node	c78daf27c42c3929758b24c2ef0baf65eea81b26b0fddfe8a5b748672d40d5f5
Related PyPI package	pystr-codec 0.1.0, 0.1.1, 0.1.2 (same endpoint)

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Malicious Ruby Gem Steals 51 Types of Credentials and Plants Backdoors in AI Coding Tools appeared first on Cyber Security News.