All news
Ruby gem worm takes AI coding tool credentials and plants agent files in repos – check yours
Socket analysed strutil-core 1.0.1, a RubyGems package that runs a credential-stealing worm when installed. It was public on November 1 for about five hours before RubyGems removed it. Besides cloud, SSH and registry secrets, the worm takes credentials of AI coding tools, adds its own entries to their local settings and, with stolen Git access, commits instruction files for coding agents into repositories.