Socket analysis of malicious strutil-core RubyGem and AI instruction poisoning

Evidence record

Original malware analysis linking installer execution with persistent agent configuration changes.

Read the original source ↗

Claim-level citations (3)

• supportsA malicious RubyGem persisted credentials theft and agent instructions: Socket reported that a malicious version of strutil-core fetched a Bun-based payload from its install hook.

  Package version and install hook analysis

• supportsA malicious RubyGem persisted credentials theft and agent instructions: The analysis identified changes targeting agent configuration files and credential-hunting behavior.

  AI tool and configuration poisoning; credential collection

• supportsA malicious RubyGem persisted credentials theft and agent instructions: Socket's analysis found install-time execution and persistent agent-instruction modifications inside the malicious strutil-core RubyGem; it did not verify execution of the destructive fallback against an actual victim.

  Socket analysis, payload stages, AI tool configuration and wiper caveats