Malicious Ruby gem steals credentials at install and may wipe files after a GitHub token is revoked
Installing a seemingly small Ruby string-helper gem runs a credential-stealing worm during setup, Socket Research reports; a separate token monitor can delete home files only after a stolen GitHub token is revoked.
- Affected
- strutil-core 1.0.1
- Fixed
- None; RubyGems removed both versions, no patched version identified
Publisher jamnajiea released clean 1.0.0 early November 1 and pushed malicious 1.0.1 under two hours later; RubyGems removed both versions about five hours after the malicious release. Socket found no confirmed victims, downstream infections, or evidence the collection endpoint was live, and 1.0.1 had zero recorded downloads.
No application must load the gem: gem install or bundle install resolving to 1.0.1 triggers extconf.rb, which downloads Bun and runs a bundled payload. The payload collects cloud, registry, SSH and AI-tool credentials, writes MCP servers and session hooks into coding-tool configurations, and repackages gems for further publication.
The home-directory deletion is conditional: a monitor installed with a stolen GitHub token runs rm -rf on home and Documents only when the token returns HTTP 401 or 403, such as after revocation. Socket advises treating any host that installed 1.0.1 as compromised and isolating it first.
Sources & technical scope 1 source
Socket Research — original source ↗
Affected: strutil-core 1.0.1
Fixed: None; RubyGems removed both versions, no patched version identified
Exploitation: No confirmed victims or downstream publication; known exploitation not established by supplied evidence
Scope & limitations: No confirmed victims or downstream infections; C2 liveness untested; download counters are not victim counts; wipe is conditional on token revocation and only installed on the GitHub-token path; remediation is isolation and credential treatment, not a vendor patch.
External findings belong to the credited researchers.