Shai-Hulud Descendant Hides in Malicious Ruby Gem to Steal Developer Secrets and Poison AI Coding Tools

A malicious RubyGems package, strutil-core 1.0.1, carried a 5.48 MB credential-stealing worm from the Miasma family that grew out of the Shai-Hulud toolkit, running as soon as a developer installed it, according to Socket research reported by GBHackers. The payload reads credentials from dozens of stores including AI coding tools, can republish to RubyGems, npm and PyPI, and writes hooks into AI tool configurations so opening an affected repository can re-run it; RubyGems removed both versions about five hours after the malicious release, and Socket confirmed no victims.