Shai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI Tools

A malicious Ruby gem named strutil-core version 1.0.1 was published and quickly removed after it was found to execute a large credential-stealing worm during installation. This worm, a descendant of the Shai-Hulud toolkit, steals credentials from various cloud services, CI systems, package registries, SSH, AI coding tools, and cryptocurrency wallets. It propagates through multiple package managers and platforms including RubyGems, npm, PyPI, JFrog Artifactory, GitHub, GitLab, and SSH. The malware installs a Python backdoor controlled via signed GitHub commits, poisons AI tool configurations to maintain persistence, and contains a conditional wiper that deletes the user's home directory if a stolen GitHub token is revoked. It targets Linux and macOS systems on x86-64 and ARM64 architectures, excluding Russian-speaking locales.

• Beyond testmetest: Native Addon Camouflage and 42 Armed GitHub Repositories Reveal a Hidden npm PublisherMalware2026-10-26
• Hacking on Autopilot: Inside ARTEX Cybercrime CampaignsCampaign2026-11-05
• Malicious cPGuard Updates Served in OpsShield Supply Chain AttackNews2026-11-04
• Belarus-Linked Hackers Deploy Wiper Malware in First Documented Destructive Attack on UkraineMalware2026-10-30
• Malicious Claude Code Extension Served in Cursor Supply Chain AttackNews2026-11-02