Filtered by tag: developer security × Clear
Malicious Ruby Gem Steals 51 Types of Credentials and Plants Backdoors in AI Coding Tools
Matched: health
A malicious Ruby gem called strutil-core (v1.0.1) stole credentials from 51 sources and planted backdoors in AI coding tools like Claude and Cursor. Live on RubyGems for roughly five hours in November 2026, it ran a payload during installation that harvested cloud keys, tokens, and crypto wallets, then sent data to attacker-controlled servers. It also added persistence hooks into AI tool config files and could delete a victim's home folder if a stolen GitHub token was revoked.