Shai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI Tools

A highly sophisticated malware payload, embedded within a seemingly innocuous Ruby gem named strutil-core (version 1.0.1), was identified. This package executes malicious code during the installation process via a native extension script that downloads and runs a JavaScript component compiled with Bun. The worm is part of the Miasma family, derived from the Shai-Hulud toolkit, and boasts severe capabilities: stealing cloud, CI/CD, SSH, wallet, and AI tool credentials; self-propagating across RubyGems, npm, PyPI, GitHub, GitLab, and JFrog Artifactory; and installing a Python backdoor triggered by signed GitHub commits. Critically, if a stolen GitHub token is revoked (receiving HTTP 401 or 403), the payload executes a conditional wiper that deletes the user's home directory.
The threat actors utilize multiple evasion techniques, including heavy string obfuscation and layered encryption on the payload within index.js. Exfiltration occurs primarily to the domain paleasbest[.]top, with fallback mechanisms pointing to public GitHub repositories or GitLab. Furthermore, when running in a GitHub Actions environment, the malware attempts memory scraping of secrets from the worker process using privileged access granted by default runner configurations. The incident timeline shows the malicious gem was published and swiftly flagged by an AI scanner before RubyGems removed both versions.

Malicious Ruby gem strutil-core version 1.0.1, published under the RubyGems account jamnajiea, was analyzed.
The installation of this gem runs a 5.48 MB credential-stealing worm from testmetest/Miasma family.
The payload reads credentials from 51 stores, including .aws/credentials and config files for AI coding tools.
It contains routines to republish code across RubyGems, npm, PyPI, JFrog Artifactory, GitHub, GitLab, and SSH.
A Python backdoor is installed via systemd service (Linux) or LaunchAgent (macOS), controlled by signed GitHub commit messages.
If a stolen GitHub token returns HTTP 401 or 403, the payload triggers a background monitor to delete the user’s home directory.
The artifact ext/strutil-core/extconf.rb has SHA-256 c5264f3b9cf2f95c83a70b7dd7430aab8abc262b853dbbcd5386c3a8a9c74769.
The malware exfiltrates data to hxxps://paleasbest[.]top/v1/api or public GitHub repositories.
Socket’s AI Scanner flagged the malware 70 seconds after strutil-core 1.0.1 was published on November 1, 2026.
The attacker utilized a PyPI sibling package, pystr-codec, which also uses the paleasbest[.]top/v1/api endpoint.

This incident exposes an evolution in supply chain compromise, moving beyond simple dependency confusion to weaponize the build and execution lifecycle of modern development tools—specifically, leveraging native extension scripts for clandestine runtime code execution. The narrative strength lies in detailing the multi-faceted persistence: from file system droppers (systemd/LaunchAgent) to network backdoors controlled by cryptographic signing (GitHub commits), creating a layered defense evasion mechanism that is exceptionally resilient.
The pattern here involves extreme operational security disguised as software hygiene. The worm doesn't just infect; it infiltrates the *process* of creation and consumption: poisoning AI tools via IDE configuration hooks, subverting CI/CD runners by scraping memory during execution, and maintaining persistence outside its initial installation scope. This architecture suggests an attacker focused not on quick financial gain, but on deep, long-term systemic access—a form of digital colonization facilitated by trusting the tooling itself.
The reliance on multiple ecosystem injectors (RubyGems $\rightarrow$ npm/PyPI) highlights a calculated strategy to achieve maximum blast radius across disparate developer environments simultaneously. The conditional wiper adds an insidious layer: making system recovery inherently risky, as revoking access (a standard security hygiene step) triggers self-destruction of the victim’s data.
What fundamental assumption does this attack exploit? It is the inherent trust placed in package installers and automated build processes. If credentials are harvested while developers believe they are running benign helper libraries, how effectively can organizational oversight detect these pre-execution compromises? Furthermore, what systemic vulnerabilities remain when credential management across disparate cloud environments (AWS, Azure, GCP) meets state-sponsored persistence tools?
Counterstrike Scan: The narrative aligns strongly with a coordinated information operation disguised as high-level technical reporting. If this were manufactured to drive vendor adoption of security products, the playbook would emphasize the *difficulty* of removal—stating clearly that "uninstalling the gem does not undo an infection"—thereby framing vendors who offer remediation/detection services as necessary arbiters of safety against unknowable persistence vectors.
Autonomy check: No autonomy signals.