---
title: Hunt: strutil-core / testmetest worm persistence, CI memory scraping and GitHub org markers | ctxsec
url: https://ctxsec.com/items/hunt-socket-strutil-core-worm-persistence-and-repo-markers
description: "Socket's write-up gives concrete host, CI and GitHub-org artifacts for the worm shipped in the strutil-core Ruby gem. Most also apply to other recent builds of the same family."
status: "hunt based on Socket Threat Research IOCs (Nov 6)"
published: 2026-11-09
---

> Socket's write-up gives concrete host, CI and GitHub-org artifacts for the worm shipped in the strutil-core Ruby gem. Most also apply to other recent builds of the same family.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-socket-strutil-core-worm-persistence-and-repo-markers.md)

hunt based on Socket Threat Research IOCs (Nov 6)

2026-11-09

### Hunt: strutil-core / testmetest worm persistence, CI memory scraping and GitHub org markers

- **Host:** systemd user services or LaunchAgents named `pkg-runtime` / `com.user.pkg-runtime` and `net-health-checker`; files `~/.local/share/runtimes/sync.py`, `~/.config/index.js`, `~/.config/net-health-checker/token`, `/var/tmp/.fontconfig_state`; `bun run` launched from `/tmp/.b_<pid>` by a Ruby process.
- **CI:** `sudo python3` reading `/proc/<pid>/mem` of `Runner.Worker`; writes to `/etc/hosts` pointing stepsecurity.io at localhost.
- **Network:** `paleasbest[.]top`.
- **GitHub orgs:** new public repos described as `project-utils` with adjective-noun-number names; `chore/ci-*` branches; commits with `skip-checks:true` or `AutoSyncComplete`; public commits containing `msync-3f7a`; a workflow named CodeQL uploading a `scan-output` artifact.
- **Repos and home dirs:** unexpected `workspace-tools` MCP entries, SessionStart hooks, `.github/init.js`, new `AGENTS.md`/`CLAUDE.md`, and folder-open tasks in `.vscode/tasks.json`.
- **Hashes (SHA-256):** gem `3b3f6e1bde0b28b015030a81a6d805b5b5306dc3f021e1102123971cfd83acc0`; index.js `306c1deec402e8b4a6478e7f0fe02194bcd224d37d8fc6ba61ad1951e8abd7a9`; extconf.rb `c5264f3b9cf2f95c83a70b7dd7430aab8abc262b853dbbcd5386c3a8a9c74769`; sync.py `c7ef186aa59b67d9b198a14f6dc8aaee6dd86510ac7c37d28f65d310cd846411`.

Sources: [Socket: Shai-Hulud descendant surfaces in malicious Ruby gem (Nov 6)](https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem)