---
title: Malicious Ruby gem carried a Shai-Hulud-family worm that steals AI coding tool credentials and plants MCP servers, SessionStart hooks and AGENTS.md in repos | ctxsec
url: https://ctxsec.com/items/socket-strutil-core-ruby-gem-shai-hulud-descendant-poisons-ai-tools
description: "Socket analyzed strutil-core 1.0.1, published Nov 1 by RubyGems account jamnajiea less than two hours after a clean 1.0.0. Its native-extension extconf.rb downloads Bun and runs a 5.48 MB worm during gem install. The worm collects cloud, CI, registry, SSH, wallet and AI tool credentials (including .claude/.credentials.json and .codex/auth.json), adds a \"workspace-tools\" MCP server and SessionStart hooks to local agent configs, and with stolen Git credentials commits .claude/settings.json, .cursor/mcp.json, CLAUDE.md, AGENTS.md and a VS Code folder-open task into repositories. A companion monitor deletes the home directory if the stolen GitHub token starts returning 401 or 403. Socket links it to the testmetest/Miasma worm family and found no public dependents or confirmed victims."
status: "security-vendor research (Socket Threat Research, Nov 6); no confirmed victims; gem removed by RubyGems after ~5 hours"
published: 2026-11-09
---

> Socket analyzed strutil-core 1.0.1, published Nov 1 by RubyGems account jamnajiea less than two hours after a clean 1.0.0. Its native-extension extconf.rb downloads Bun and runs a 5.48 MB worm during gem install. The worm collects cloud, CI, registry, SSH, wallet and AI tool credentials (including .claude/.credentials.json and .codex/auth.json), adds a "workspace-tools" MCP server and SessionStart hooks to local agent configs, and with stolen Git credentials commits .claude/settings.json, .cursor/mcp.json, CLAUDE.md, AGENTS.md and a VS Code folder-open task into repositories. A companion monitor deletes the home directory if the stolen GitHub token starts returning 401 or 403. Socket links it to the testmetest/Miasma worm family and found no public dependents or confirmed victims.

[← Context & Harness Attacks](/context) · [markdown](/items/socket-strutil-core-ruby-gem-shai-hulud-descendant-poisons-ai-tools.md)

security-vendor research (Socket Threat Research, Nov 6); no confirmed victims; gem removed by RubyGems after ~5 hours

2026-11-09

### Malicious Ruby gem carried a Shai-Hulud-family worm that steals AI coding tool credentials and plants MCP servers, SessionStart hooks and AGENTS.md in repos

- **Exposure window:** about five hours on Nov 1 before RubyGems removed both versions. A PyPI sibling, `pystr-codec` 0.1.0 to 0.1.2, uses the same `paleasbest[.]top` endpoint.
- **Why it matters for agents:** opening an infected repository in an AI coding tool or VS Code can re-run the worm, depending on that tool's workspace trust and approval settings; the generated AGENTS.md tells agents to run a setup script first.
- **Order matters if infected:** isolate the host and remove `net-health-checker` and `pkg-runtime` before revoking the GitHub token, or the wiper fires.

Sources: [Socket: Shai-Hulud descendant surfaces in malicious Ruby gem (Nov 6)](https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem)