Loading story…
Security researchers identified multiple malicious open source packages designed to impersonate widely used libraries in the Go and Rust ecosystems. In the Go ecosystem, two packages (github.com/bpoorman/uuid and github.com/bpoorman/uid) mimicked trusted UUID libraries, embedding a covert backdoor that exfiltrated data to a pastebin-style service using a hardcoded API token. These packages maintained legitimate functionality to avoid detection and remained accessible in public repositories for years, potentially exposing a large number of downstream projects to data theft.
Similarly, in the Rust ecosystem, a malicious crate named finch-rust was discovered impersonating the legitimate bioinformatics tool finch. This typosquatted package included a hidden dependency on sha-rust, a credential-stealing component that evolved rapidly over several iterations. The malicious code was triggered by a subtle function call, making it difficult to detect during routine code review. Both incidents highlight the ongoing threat of typosquatting and supply chain attacks in open source software, emphasizing the need for vigilant package vetting and prompt response from security teams.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
Socket also published research on malicious Go packages impersonating Google's UUID library and exfiltrating data. The reference provides the existence of the disclosure but no further incident details in the supplied content.
Socket publicly reported the typosquatting and credential-exfiltration campaign involving 'finch-rust' and 'sha-rust', detailing the attacker’s impersonation tactics and malware behavior. The disclosure highlighted the growing sophistication of software supply chain threats in the Rust ecosystem.
After being notified of the supply chain attack, the Rust Security team removed the malicious packages from crates.io. This disrupted the credential-stealing campaign targeting Rust developers.
Over roughly two weeks, the attacker rapidly updated the malicious Rust package through eight versions while using fake GitHub repositories and spoofed commit authorship to appear legitimate. The payload was designed to trigger only during specific library operations and exfiltrate files such as .env, config.toml, and id.json to attacker-controlled infrastructure.
An attacker using the alias 'faceless' published a typosquatted Rust crate named 'finch-rust' to impersonate the legitimate 'finch' bioinformatics tool. The package included a hidden malicious dependency, 'sha-rust', designed to steal credentials and sensitive files.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers identified two major supply chain attacks involving malicious open-source packages in September 2025. Over 500 npm packages were infected by the self-propagating Shai-Hulud worm, which steals sensitive data and hijacks developer credentials to further spread the malware. Separately, two Rust crates impersonating a legitimate logging library were discovered stealing Solana and Ethereum wallet keys from developers' source code, with over 8,400 downloads before removal. Both incidents highlight the growing threat of malicious packages in widely used software repositories, putting developers and organizations at risk of credential theft and further compromise.
Jun 29, 2026
Security researchers have uncovered multiple campaigns involving malicious npm packages designed to steal developer credentials and sensitive information from Windows, macOS, and Linux systems. In one operation, ten typosquatted packages impersonated popular libraries such as TypeScript, discord.js, ethers.js, and others, using sophisticated obfuscation, fake CAPTCHA prompts, and postinstall hooks to deploy an information stealer that harvested credentials from system keyrings, browsers, and authentication services. The malware executed in a new terminal window to evade detection and sent stolen data, including IP addresses, to external servers. Another large-scale campaign, dubbed 'PhantomRaven,' involved 126 npm packages and over 86,000 downloads, targeting authentication tokens, CI/CD secrets, and GitHub credentials. These packages leveraged remote dynamic dependencies to fetch and execute payloads during installation, profiling infected devices and exfiltrating secrets for potential supply chain attacks. The attackers employed techniques such as slopsquatting, where AI-generated package recommendations led developers to install non-existent, malicious packages. Some packages impersonated tools from GitLab and Apache, and many remained available on npm at the time of reporting. The campaigns highlight the ongoing risks in the npm ecosystem, with attackers exploiting both user trust and platform weaknesses to compromise developer environments and CI/CD pipelines. Security experts warn that the theft of tokens and credentials could enable further attacks, including the introduction of malicious code into legitimate projects and broader supply chain compromises.
Jun 29, 2026
Security researchers have identified sophisticated supply chain attacks leveraging typosquatting on popular open source package repositories. In one campaign, a malicious NPM package named `polymarket-clob@1.3.1` was discovered targeting cryptocurrency traders by impersonating a legitimate Polymarket Central Limit Order Book (CLOB) library. Upon installation, the package exfiltrates sensitive wallet files, private keys, and environment secrets to an attacker-controlled server, exploiting the trust in open source dependencies within the crypto ecosystem. The package's metadata was crafted to appear credible, with fabricated author details and a plausible description, making it difficult for users to distinguish from legitimate software. Separately, a novel malware was found on Maven Central, masquerading as a Jackson JSON library extension through a subtle namespace typosquatting attack (`org.fasterxml.jackson.core` instead of the legitimate `com.fasterxml.jackson.core`). This malware employed multi-stage payloads, encrypted configurations, and platform-specific executables, demonstrating a high level of sophistication and obfuscation. The attackers also registered a lookalike domain (`fasterxml.org`) to further deceive users. The malicious package was quickly reported and removed, but the incident highlights the growing threat of supply chain attacks in less-targeted ecosystems like Maven Central, as attackers adapt to increased defenses in other repositories.
Jun 29, 2026