Hackers are deploying a new Shai-Hulud malware variant designed to steal credentials and manipulate AI tools through a malicious RubyGems package.
In research published Friday, Socket Security said attackers pushed a malicious RubyGems package called strutil-core. Once installed, the package deployed a new build of the testmetest worm, part of the Miasma malware family that grew out of the publicly released Shai-Hulud toolkit. JFrog previously linked testmetest to 42 hijacked GitHub repositories.
RubyGems removed the malicious package and a benign version of it about five hours after the malicious release.
“We found no public projects that depended on it, and we have not confirmed any victims or any packages the worm infected from it,” Socket Security said.
A sandbox run by Bitbison confirmed the package ran its payload on install. Socket said attackers disguised strutil-core as a lightweight string manipulation helper that executed the payload when victims installed the package. The payload, which contained a RubyGems propagation module, then proceeded to collect credential files and environment variables for cloud providers, package registries, Git hosts and AI coding tools.
When a stolen GitHub token was accepted, the malware installed a background monitor. If the token was then revoked, the monitor would delete the user’s home directory, Socket said.
In addition to the RubyGems injector, the bundle contained publishing routines for npm and PyPI packages.
The worm also writes rogue MCP server entries, session hooks and agent instruction files such as AGENTS.md and Claude and Cursor settings into local configurations and repositories. Opening an affected repository in an AI coding tool can re-run the worm, depending on the tool’s trust settings, Socket said.
Socket advised affected organizations to isolate the machine and remove the malware’s monitor before revoking any stolen GitHub token, as revoking it is what triggers the deletion.
Socket Security did not immediately respond to a request for comment.
