The strutil-core gem combined install-time code execution with agent instruction-file modifications and attempted propagation. Entry and authority. A developer installed the compromised RubyGem with extension execution enabled under a user that had local credentials and AI instruction files. Observed mechanism and consequence. The installer retrieved an…
Inspect the ClaimsCase · DiggingBeagle record
A malicious RubyGem persisted credentials theft and agent instructions
The strutil-core gem combined install-time code execution with agent instruction-file modifications and attempted propagation.
Public disclosure: Nov 9, 2026
Scope
A developer installed the compromised RubyGem with extension execution enabled under a user that had local credentials and AI instruction files. The installer retrieved an executable stage that could access developer secrets and modify CLAUDE.md/AGENTS.md and other agent control artifacts.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- observed live
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-SHAIRUBY; reviewed as incident in production. Evidence of reported deployed or live observations does not alone establish complete victim losses or actor attribution.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-SHAI-RUBY-SKILL-PERSIST-01 · CLM-DB233-SHAI-RUBY-SKILL-PERSIST-02 · CLM-ENR234-DB233-SHAI-RUBY-SKILL-PERSIST · Socket analysis of malicious strutil-core RubyGem and AI instruction poisoning
At a glance
Relatedness to pystr-codec remains an infrastructure or payload overlap, not confirmed common operators. No verified victim count, realized propagation or destructive-wipe outcome.
Limits and uncertaintyFull account
The strutil-core gem combined install-time code execution with agent instruction-file modifications and attempted propagation.
Entry and authority. A developer installed the compromised RubyGem with extension execution enabled under a user that had local credentials and AI instruction files.
Observed mechanism and consequence. The installer retrieved an executable stage that could access developer secrets and modify CLAUDE.md/AGENTS.md and other agent control artifacts.
Limits and status. Relatedness to pystr-codec remains an infrastructure or payload overlap, not confirmed common operators. No verified victim count, realized propagation or destructive-wipe outcome.
The published strutil-core RubyGem ran code during installation, collected credentials and altered agent instruction/configuration files to influence later coding activity. It also contained propagation and destructive fallback logic. Analysis of package bytes supports malicious intent and code paths, but the presence of a wiper branch does not establish that a user's home directory was actually erased. Infrastructure overlap with another malicious package does not by itself identify the operator.
Mechanism and trust boundary
- 01
Precondition and trust context
A developer installed the compromised RubyGem with extension execution enabled under a user that had local credentials and AI instruction files.
- 02
Crossed boundary
The installer retrieved an executable stage that could access developer secrets and modify CLAUDE.md/AGENTS.md and other agent control artifacts.
- 03
Observed limit
Relatedness to pystr-codec remains an infrastructure or payload overlap, not confirmed common operators. No verified victim count, realized propagation or destructive-wipe outcome.
Timeline
- Nov 9, 2026Event type unspecified
Initial documented finding
A malicious RubyGem persisted credentials theft and agent instructions
- Nov 9, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-SHAI-RUBY-SKILL-PERSIST-01Socket reported that a malicious version of strutil-core fetched a Bun-based payload from its install hook.supported
Basis: reported finding
- supportsSocket analysis of malicious strutil-core RubyGem and AI instruction poisoningindependent technical reproduction
Package version and install hook analysis
CLM-DB233-SHAI-RUBY-SKILL-PERSIST-02The analysis identified changes targeting agent configuration files and credential-hunting behavior.supported
Basis: reported finding
- supportsSocket analysis of malicious strutil-core RubyGem and AI instruction poisoningindependent technical reproduction
AI tool and configuration poisoning; credential collection
CLM-ENR234-DB233-SHAI-RUBY-SKILL-PERSISTSocket's analysis found install-time execution and persistent agent-instruction modifications inside the malicious strutil-core RubyGem; it did not verify execution of the destructive fallback against an actual victim.supported
Basis: reported finding
- supportsSocket analysis of malicious strutil-core RubyGem and AI instruction poisoningindependent technical reproduction
Socket analysis, payload stages, AI tool configuration and wiper caveats
Controls and mitigations
- Remove the malicious gem version, rotate exposed cloud/developer/AI credentials and inspect files such as AGENTS.md, CLAUDE.md and MCP configuration for unauthorized changes.
- Preserve package artifacts and host logs before cleanup; block install-time scripts or run them under least privilege for untrusted dependencies.
Unknowns and contradictions
- Relatedness to pystr-codec remains an infrastructure or payload overlap, not confirmed common operators. No verified victim count, realized propagation or destructive-wipe outcome.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235