Shai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI Tools

Socket's Threat Research Team discovered strutil-core 1.0.1, a malicious RubyGems package published by account 'jamnajiea' that embeds a 5.48 MB credential-stealing worm derived from the Shai-Hulud toolkit, identified as a new build of the testmetest worm from the Miasma family. The gem uses a native extension hook (extconf.rb) to download the Bun JavaScript runtime and execute a payload at install time, stealing credentials from cloud providers, CI systems, package registries, SSH, AI coding tools, and cryptocurrency wallets, exfiltrating them to paleasbest[.]top. The worm self-propagates by injecting itself into gems, npm, and PyPI packages using stolen API keys, and installs a Python backdoor (sync.py) controlled via signed GitHub commit messages. It poisons AI coding tools by writing malicious MCP server configs, session hooks, and agent instruction files both locally and into repositories. A particularly destructive feature is a 'wiper' that deletes the user's home directory if a stolen GitHub token is revoked (returning HTTP 401/403). Socket's AI Scanner flagged the malicious version 70 seconds after publication; RubyGems removed both versions approximately five hours after the malicious release. A related PyPI package, pystr-codec, shares the same C2 endpoint.