Malicious Ruby gem tied to testmetest worm steals credentials

published 2026-11-06

An attacker gets your credentials, including tokens and SSH or API keys, and can use them to spread the worm to other machines and software ecosystems. It also poisons AI tools and can wipe your entire home directory.

Source: @Cyber_O51NT on X

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 1774 and your operating system.