---
title: Tip: on a host hit by a Shai-Hulud-family worm, remove the token monitor before you revoke the stolen GitHub token | ctxsec
url: https://ctxsec.com/items/tip-worm-token-wiper-remove-monitor-before-revoking-github-token
description: "The strutil-core build installs a net-health-checker service that polls GitHub every 45 seconds for up to 48 hours and runs rm -rf on the home directory as soon as the stolen token returns 401 or 403. Revoking the token first, the usual reflex, triggers the wipe."
status: "incident-response guidance (Socket Threat Research, Nov 6)"
published: 2026-11-09
---

> The strutil-core build installs a net-health-checker service that polls GitHub every 45 seconds for up to 48 hours and runs rm -rf on the home directory as soon as the stolen token returns 401 or 403. Revoking the token first, the usual reflex, triggers the wipe.

[← Tips & Guides](/tips) · [markdown](/items/tip-worm-token-wiper-remove-monitor-before-revoking-github-token.md)

incident-response guidance (Socket Threat Research, Nov 6)

2026-11-09

### Tip: on a host hit by a Shai-Hulud-family worm, remove the token monitor before you revoke the stolen GitHub token

- Isolate the host from the network.
- Stop and remove `net-health-checker` and `pkg-runtime` (systemd user units or LaunchAgents) and preserve `~/.config/net-health-checker/token` as evidence.
- Then revoke the GitHub token and rotate every other credential from a clean device, and rebuild the host.

Sources: [Socket: Shai-Hulud descendant surfaces in malicious Ruby gem (Nov 6)](https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem)