Loading story…
A malicious Rust package named evm-units was discovered on Crates.io, posing as a legitimate Ethereum utility but secretly delivering cross-platform payloads to compromise developers' systems. The package, authored by 'ablerust' and downloaded over 7,000 times, was designed to appear as a genuine Uniswap helper library, returning plausible Ethereum version numbers while executing hidden malicious code. Upon invocation of the get_evm_version() function, the package would download and execute a payload tailored to the victim's operating system, with additional logic to evade detection by checking for the presence of Qihoo360 antivirus, a product popular in Asian markets.
The malicious activity was active for approximately eight months before being swiftly removed from Crates.io following its discovery and reporting by the Socket Threat Research Team. The package's behavior suggests a focus on cryptocurrency theft, leveraging stealthy execution and targeting developers in regions where Qihoo360 is prevalent. The incident highlights the ongoing risks of supply chain attacks in open-source ecosystems, particularly for developers in the cryptocurrency sector who may be targeted for their access to digital assets and sensitive codebases.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Following discovery, the malicious packages evm-units and uniswap-utils were removed from the Rust package registry. The crates.io team also disabled the publisher account associated with the packages, 'ablerust'.
Socket Threat Research Team discovered that evm-units functioned as a cross-platform second-stage loader for Windows, macOS, and Linux, using a seemingly benign function to fetch and execute OS-specific payloads. Researchers also noted anti-analysis behavior, including checks for Qihoo 360 antivirus, and assessed the campaign as likely aimed at cryptocurrency theft, especially in Asian markets.
The malicious evm-units crate accumulated more than 7,000 downloads and was also included as a dependency in another package, uniswap-utils, increasing the supply-chain exposure to developers. The related package also reached roughly similar download counts before takedown.
The Rust package evm-units, published by the author 'ablerust' while posing as an Ethereum Virtual Machine helper tool, was uploaded to crates.io. Reporting indicates it had been available since April 2025 and remained on the registry for about eight months.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
5 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourcescworld.com
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two malicious Rust packages, named 'faster_log' and 'async_println', were discovered on the official Crates.io repository, where they were designed to steal private keys from cryptocurrency wallets, specifically targeting Solana and Ethereum users. These packages were downloaded nearly 8,500 times before their removal, with 'faster_log' accounting for 7,200 downloads and 'async_println' for 1,200. The malicious crates impersonated the legitimate 'fast_log' crate by copying its README file, repository metadata, and maintaining the original logging functionality to avoid suspicion among developers. The attackers embedded a payload within the crates that, upon execution, scanned the victim's environment and project source files for sensitive information, including hex strings resembling Ethereum private keys, Base58 strings similar to Solana keys or addresses, and bracketed byte arrays that could contain keys or seeds. When such data was found, it was bundled with the file path and line number and exfiltrated to a hardcoded Cloudflare Worker URL, which was confirmed to be live and accepting POST requests during the investigation. The malicious activity was discovered by researchers at the code security company Socket, who promptly reported it to Crates.io. In response, Crates.io removed both packages and suspended the publishing accounts, 'rustguruman' and 'dumbnbased', on September 24th. The incident highlights the risks associated with open-source software supply chains, where attackers can leverage trusted repositories to distribute malware to unsuspecting developers. The malicious crates did not have any dependent downstream crates, which may have limited the spread of the compromise. The attack demonstrates the sophistication of threat actors in mimicking legitimate projects to evade detection and the importance of vigilant monitoring of package repositories. The use of a legitimate logging functionality within the malicious crates further reduced suspicion, allowing the packages to remain undetected for several months. The exfiltration endpoint used by the attackers was not an official Solana RPC endpoint, indicating a deliberate attempt to disguise the data theft operation. This supply chain attack underscores the need for developers to verify the authenticity of third-party packages and for repository maintainers to implement robust security controls. The incident also serves as a warning to the broader cryptocurrency and developer communities about the ongoing threat of targeted attacks seeking to compromise digital assets through software dependencies. Security researchers continue to monitor for similar threats and advise immediate removal of the affected packages from any projects.
Jun 29, 2026
Researchers have uncovered a series of malicious packages published to the NuGet open-source platform, specifically targeting cryptocurrency users and developers. These packages, such as the impersonation of the legitimate `Nethereum` library, were designed to steal crypto funds by redirecting transactions to attacker-controlled wallets and exfiltrating sensitive secrets. The campaign, active since at least July 2025, involved at least 14 packages that mimicked legitimate crypto-related tools, using techniques like homoglyphs and typosquatting to evade detection and appear trustworthy. The malicious code was carefully hidden within copied legitimate functionality, making analysis and detection more challenging for defenders. The attackers leveraged multiple open-source ecosystems in their broader campaign, but the recent focus on NuGet marks a significant escalation. The packages were published by various authors over several months, and their malicious intent included both direct theft of funds and the collection of credentials for later exploitation. Security researchers emphasize the sophistication of these attacks, highlighting the need for increased vigilance when using third-party packages in development environments, especially those related to cryptocurrency operations.
Jun 29, 2026
Threat researchers identified two malicious Rust crates, faster_log and async_println, that impersonated the legitimate fast_log library to steal Solana and Ethereum private keys from developers. The crates, published under the aliases rustguruman and dumbnbased, embedded routines to scan source files for wallet keys and exfiltrate them to a hardcoded command and control endpoint. Combined, the malicious packages were downloaded over 8,400 times before being reported and removed from the Rust package registry. The Crates security team responded promptly by removing the listings, locking the associated accounts, and publishing a security advisory to alert the community. This incident highlights the ongoing risk of supply chain attacks in open source ecosystems and the importance of vigilant package vetting.
Jun 29, 2026