strutil-core Malicious Ruby Gem: A Fake Text Helper Ran a Credential-Stealing Worm at Install, What Is Confirmed and What to Check This Week

A RubyGems package called strutil-core claimed to be a harmless text helper, but it ran a credential-stealing worm the moment a developer installed it. If anyone who writes code for your business, whether in-house or at an agency, installed version 1.0.1, treat every password, cloud key and access token on that machine as stolen.

The gem has been taken off RubyGems and researchers have not confirmed any victims. The way it worked is still worth understanding, because the same trick works against any company that builds or runs software.

What happened with the strutil-core Ruby gem

Socket's Threat Research Team published its analysis on Friday, November 6, 2026. According to that report:

• strutil-core 1.0.0 was published on Sunday, November 1, 2026 at 02:19:56 UTC. Socket calls it a clean seed release.
• Version 1.0.1 followed at 04:05:04 UTC the same day, less than two hours later, and carried the malicious payload.
• Socket's scanner flagged the malicious file 70 seconds after 1.0.1 was published.
• RubyGems removed both versions about five hours after the malicious release.

The open source malware database OSV lists the package as MAL-2026-19054, published November 1, 2026. It marks version 1.0.1 as affected and credits Bitbison with the finding. The RubyGems page for strutil-core now says the gem "is not currently hosted on RubyGems.org."

The gem's description promised "Lightweight string manipulation helpers: slug, truncate, normalize." Socket found that the Ruby code included only the slug helper. Most of the package was a 5.4 MB obfuscated JavaScript program.

How installing a Ruby gem can run malware

Some gems include native code that is compiled during installation, and RubyGems runs a build script called extconf.rb to do it. strutil-core abused that step. Its extconf.rb did no real building. On Linux and macOS it downloaded the Bun JavaScript runtime, ran the hidden JavaScript file, then wrote an empty build file so the install finished with no errors.

That means gem install or bundle install was enough. No application ever had to load the gem. A developer testing a new library, or a build server installing dependencies, would have run the malware with no visible sign.

What the strutil-core malware does

It helps to keep what was observed apart from what the code is built to do.

Observed in a sandbox: Socket cites Bitbison's sandbox, which recorded the payload reading 51 credential stores. These covered cloud providers, CI systems, package registries, Git hosts, SSH, Docker, Kubernetes, HashiCorp Vault, password managers, operating system keychains, crypto wallets and AI coding tools. The files named include .aws/credentials, .npmrc, .gem/credentials, .kube/config, .claude/.credentials.json and .codex/auth.json. If it finds AWS keys, it reaches into Secrets Manager and SSM across 17 regions.

Built into the code: Socket describes routines that:

• Add an MCP server named workspace-tools, or SessionStart hooks, to AI coding tool settings so the malware runs again later.
• Use stolen Git access to commit files such as .claude/settings.json, .cursor/mcp.json, CLAUDE.md, AGENTS.md and .vscode/tasks.json to repositories. Socket says opening an affected repository "can re-run the worm, depending on that tool's workspace trust and approval settings."
• Install a background service called pkg-runtime that checks GitHub every hour for new signed instructions.
• Republish the worm inside other gems using a stolen RubyGems key. There are also routines for npm and PyPI.

Not confirmed: Socket says it found no public projects that depend on the gem and has not confirmed any victims. It has also "not confirmed any successful downstream publication from this gem." Early tracking showed 89 downloads, all of version 1.0.0. Socket says these likely came from mirrors and scanners, and that download counts are not victim counts.

Socket links the code to the publicly released Shai-Hulud worm toolkit and calls it "a later build of the testmetest worm." It also notes that the toolkit's source code has been public since May 2026, so shared code does not prove the same people are behind every version.

Revoking the stolen token can wipe the machine

This detail changes how you should respond. When the malware steals a GitHub token, it installs a monitor called net-health-checker that tests the token every 45 seconds. Once the token stops working, which is exactly what revoking it does, the monitor deletes the user's home folder. Socket says the monitor runs for 48 hours.

So the usual first move, revoking the token right away, can destroy the developer's files and the evidence along with them. Socket's advice is to isolate the machine and remove net-health-checker and pkg-runtime first. After that, rotate credentials from a clean device and rebuild the machine.

Why this matters for a company network or website

Developer laptops and build servers usually hold the keys to production: cloud accounts, code repositories, package publishing rights and deployment secrets. One bad install on one of those machines can expose all of them. If an agency or contractor builds your website or app, their machines count too.

AI coding tools add another route. They read settings and instruction files straight from the repository, so a poisoned AGENTS.md or MCP config can sit in your codebase until it runs on the next person's machine.

What to do this week

A lockfile will not stop someone adding a bad package on purpose, but it does stop silent changes. A review step catches a library published by an account nobody has heard of.

strutil-core questions people are asking

Was my company affected by strutil-core?

Only if a machine installed version 1.0.1, which was available for about five hours on November 1, 2026. Check lockfiles, build logs, CI caches and container images. Socket has not confirmed any victims.

Was strutil-core a typosquatting attack?

Socket describes it as a new, standalone gem, not a hijacked existing package. Its report does not say the name copied a specific popular gem. Either way, new and unfamiliar packages deserve a look before anyone installs them.

Is strutil-core related to Shai-Hulud?

Socket says it shares code and markers with descendants of Shai-Hulud. Because that code is public, the overlap does not prove the same attacker is behind it.

Does installing a Ruby gem really run code?

Yes. Gems with native extensions run a build script during installation. That is normal behaviour, and it is the step strutil-core abused.

Should I revoke a stolen GitHub token right away?

Not until you have checked for net-health-checker. Remove it first, then revoke and rotate from a clean device.

Is there a patch for strutil-core?

No. This is a malicious package, not a bug in a legitimate one. The fix is to remove it, clean up the machine and rotate credentials.

The bigger lesson

Every package you install is a stranger's code running with your permissions. The defences are not exotic. Know what your developers install, keep build machines locked down, store secrets in as few places as possible and keep them short-lived, and have a plan for rotating them in the right order.

For help locking down developer machines and build pipelines, see security hardening or request a quote.

Get security alerts like this by email, with the free checklist, at our security alerts page.

Sources: Socket Threat Research: Shai-Hulud Descendant Surfaces in Malicious Ruby Gem; OSV: MAL-2026-19054, Malicious code in strutil-core.