The report
Installing a RubyGem could alter the instructions subsequently read by a coding agent. Socket reported that malicious strutil-core version 1.0.1, published November 1, used an install hook to fetch a large Bun-based JavaScript payload. The code harvested credentials and modified files including CLAUDE.md, AGENTS.md, .claude/settings.json and .cursor/mcp.json. That gives the incident's AI-specific dimension: a conventional package-install compromise also attempted to shape later agent behavior.
The hook ran before the agent needed to act
The entry point was RubyGems installation, not an injected chat message. A project dependency's build hook executed in the installer's environment and downloaded a second-stage program. The observed code was designed to look for cloud, CI, SSH, wallet and AI-service credentials. It also contained GitHub/GitLab exfiltration and further package-propagation logic.
The agent instruction files had a separate role. They could persist beyond the initial installer process and influence future sessions that consume those project files or local settings. The technique does not require the model to invent an exploit; the attacker has already changed what appears to be ordinary workspace guidance.
Socket connected elements of the payload and infrastructure to related malicious packages. Its analysis describes a potential destructive fallback under specific token-failure conditions, but did not verify a real victim's home directory deletion or successful downstream worm spread. The malicious version was reportedly removed within hours. Download or exposure counts do not automatically measure execution or data theft.
A recovery check that cannot stop at uninstalling
Removing a package version stops one future installation path. It does not undo altered agent instructions, copied secrets or user-owned files created by an earlier install. Investigation should preserve install logs and artifact hashes, inspect the named workspace instruction files and agent settings, and rotate credentials that may have been accessible to the payload.
The primary Socket analysis establishes the install-time and persistent-file mechanisms. Claims about who operated the campaign or how many systems were subsequently compromised require evidence outside the package sample.