A Ruby gem once posing as a harmless string utility has been exposed as a dangerous credential-stealing worm. Strutil-core, a malicious package on RubyGems, grabbed 51 different kinds of credentials and embedded backdoors into AI coding tools. Even canceling a compromised GitHub token could trigger deletion of the user’s home folder.
Released in version 1.0.0 on November 1, 2026, by the account “jamnajiea,” the gem initially appeared benign. But less than two hours later, version 1.0.1 was published with a hidden payload of about 5.48 MB that activates as soon as the gem is installed. Beyond passwords, it targeted AWS keys, package registry tokens, SSH keys, crypto wallets, Kubernetes secrets, cloud configuration files, and more. RubyGems removed both versions shortly after.
How the Attack Works
The malicious behavior is hidden in a native extension script called extconf.rb which executes during the build/install phase—so even before the gem is loaded by any application. It downloads the Bun JavaScript runtime and runs malicious payloads in the background on Linux and macOS systems. Once running, the worm encrypts stolen credentials and sends them to a command-and-control server at paleasbest.top. If that fails, it attempts to leak the data via GitHub or GitLab repositories.
On CI runners like GitHub Actions, the worm reads secrets directly from process memory, similar to the exploit vector used during the 2025 tj-actions breach. It also attempts to disable parts of security agents like the StepSecurity Harden-Runner, though those efforts reportedly fail.
Backdoor Into AI Tools & Persistence Strategy
The malware also tampers with settings for AI developer tooling—modifying settings.json, mcp.json, .aider.conf.yml, and others. It inserts fake “workspace-tools” MCP servers, attaches session start hooks to run code when opening folders, and plants task files in repos to reinfect compromised machines depending on trust levels.
For ongoing control, a Python backdoor named sync.py periodically checks GitHub commits for a secret marker (“msync-3f7a”) to pull and run attacker-signed code. It belongs to the Miasma family of malware linked to the public Shai-Hulud toolkit. Worst of all: if a stolen GitHub token is revoked—something you might try to block the attack—the worm’s monitor tool may delete the entire home directory.
What Developers Should Do Now
If you ever installed strutil-core version 1.0.1, assume both the device and any credentials accessible from it are compromised. Immediate steps include isolating the affected host, removing suspicious processes like net-health-checker and pkg-runtime, and revoking compromised GitHub tokens. After that, rotate all secrets from a clean system, rebuild compromised machines, audit CI workflows, container images, and remove unknown entries like workspace-tools from editor or AI tool settings.
Indicators include: the package name strutil-core (v1.0.1), account “jamnajiea,” gems authored under “Mark Tillman,” the domain paleasbest[.]top, several SHA-256 hashes of payload files, and related PyPI packages named pystr-codec (versions 0.1.0-0.1.2) that point back to the same infrastructure.
This incident highlights a broader shift in developer supply-chain attacks. Attackers are not just aiming at servers or cloud infrastructure—they’re going after laptops, dev environments, and AI-assisted coding workflows. Strutil-core follows fake packages that target settings for Cursor, Claude, and AI agent tools. Backdoors are now being planted earlier in the build/install process and getting embedded into everyday developer tools.
Organizations should enforce strict package vetting, lock down CI permissions, and monitor unusual behavior during installs—not just runtime. Also, workspace settings for AI tools need scrutiny: any unknown server entries, session hooks, or auto-run tasks should raise red flags. The risk landscape now includes not only what code is pulled, but what happens before even a line of code runs.
