syslog.eu
CS EN DE FR
[WARNING · CHECK THIS WEEK]/News·

Ruby gem worm takes AI coding tool credentials and plants agent files in repos – check yours

Socket analysed strutil-core 1.0.1, a RubyGems package that runs a credential-stealing worm when installed. It was public on November 1 for about five hours before RubyGems removed it. Besides cloud, SSH and registry secrets, the worm takes credentials of AI coding tools, adds its own entries to their local settings and, with stolen Git access, commits instruction files for coding agents into repositories.

Affected claude-code cursor rubygems vs-code
Syslog card, level WARNING (check this week): Worm poisons AI tools, A Ruby gem plants agent files in repos. Affected: RubyGems, Claude Code, Cursor, VS Code. To do: Check repos for agent files nobody added; Review MCP servers in AI coding tools.

Does this concern you?

  • Affected: directly, machines that installed strutil-core 1.0.1. In our view, any team whose developers install open-source packages and use AI coding tools (Claude Code, Codex, Cursor, Gemini) or VS Code should look for the planted files.
  • Skip it if: nobody at your company installs packages or runs coding agents.

What to do

  • If you use Ruby: search Gemfile.lock files, CI caches and container images for strutil-core.
  • In repositories and home directories: look for changes nobody made to AGENTS.md, CLAUDE.md, .claude/settings.json, .cursor/mcp.json, .gemini settings, .vscode/tasks.json or .github/init.js, for an MCP server (a tool the AI assistant can start) named workspace-tools, and for SessionStart hooks (commands run when a session starts).
  • Signs of infection: services named pkg-runtime or net-health-checker, the files ~/.config/index.js or /var/tmp/.fontconfig_state, new public repositories in your GitHub organisation described as project-utils, or commits containing AutoSyncComplete.
  • If a machine is infected: isolate it. Remove net-health-checker and pkg-runtime, then revoke the GitHub token, rotate every credential the machine could reach from a clean device, and rebuild it. Removing the gem is not enough.
  • Don't: revoke the GitHub token first – a failing token makes net-health-checker delete the user's home directory.
  • In our view, keep workspace trust and approval prompts on; Socket says whether opening a repository re-runs the worm depends on them.

What we know – and what we don't

  • A clean 1.0.0 preceded the malicious 1.0.1 by under two hours. Socket found no projects depending on the gem and has confirmed no victims.
  • In Bitbison's sandbox, the gem read files such as .claude/.credentials.json and .codex/auth.json. Socket's other findings come from the code.
  • The planted AGENTS.md tells agents to run a setup script before their first command; the VS Code task runs when the folder opens.
  • The code can republish npm and PyPI packages; Socket has seen none from this gem. How many systems installed it is unknown. A PyPI package, pystr-codec, uses the same collection server.
  • Socket ties the worm to the Miasma family built on the Shai-Hulud toolkit, public since May 2026, so shared code does not prove one operator.

Why it matters

Agent instruction files look like documentation, and nobody reviews them like code. Yet a coding agent follows them. A repository is now something your tools act on, not just read.

Sources

← All news