Loading story…
Two malicious Rust packages, named 'faster_log' and 'async_println', were discovered on the official Crates.io repository, where they were designed to steal private keys from cryptocurrency wallets, specifically targeting Solana and Ethereum users. These packages were downloaded nearly 8,500 times before their removal, with 'faster_log' accounting for 7,200 downloads and 'async_println' for 1,200. The malicious crates impersonated the legitimate 'fast_log' crate by copying its README file, repository metadata, and maintaining the original logging functionality to avoid suspicion among developers. The attackers embedded a payload within the crates that, upon execution, scanned the victim's environment and project source files for sensitive information, including hex strings resembling Ethereum private keys, Base58 strings similar to Solana keys or addresses, and bracketed byte arrays that could contain keys or seeds. When such data was found, it was bundled with the file path and line number and exfiltrated to a hardcoded Cloudflare Worker URL, which was confirmed to be live and accepting POST requests during the investigation. The malicious activity was discovered by researchers at the code security company Socket, who promptly reported it to Crates.io. In response, Crates.io removed both packages and suspended the publishing accounts, 'rustguruman' and 'dumbnbased', on September 24th. The incident highlights the risks associated with open-source software supply chains, where attackers can leverage trusted repositories to distribute malware to unsuspecting developers. The malicious crates did not have any dependent downstream crates, which may have limited the spread of the compromise. The attack demonstrates the sophistication of threat actors in mimicking legitimate projects to evade detection and the importance of vigilant monitoring of package repositories. The use of a legitimate logging functionality within the malicious crates further reduced suspicion, allowing the packages to remain undetected for several months. The exfiltration endpoint used by the attackers was not an official Solana RPC endpoint, indicating a deliberate attempt to disguise the data theft operation. This supply chain attack underscores the need for developers to verify the authenticity of third-party packages and for repository maintainers to implement robust security controls. The incident also serves as a warning to the broader cryptocurrency and developer communities about the ongoing threat of targeted attacks seeking to compromise digital assets through software dependencies. Security researchers continue to monitor for similar threats and advise immediate removal of the affected packages from any projects.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers and security outlets disclosed that the malicious Rust crates on Crates.io were stealing crypto wallet keys, bringing public attention to the supply-chain attack. Reporting identified the campaign as targeting Solana and Ethereum private keys through trojanized packages.
A set of malicious Rust packages was published on Crates.io as part of a supply-chain attack aimed at stealing cryptocurrency wallet private keys. The packages targeted Solana and Ethereum-related secrets and were designed to exfiltrate sensitive key material from developers or users who installed them.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers identified two malicious Rust crates, faster_log and async_println, that impersonated the legitimate fast_log library to steal Solana and Ethereum private keys from developers. The crates, published under the aliases rustguruman and dumbnbased, embedded routines to scan source files for wallet keys and exfiltrate them to a hardcoded command and control endpoint. Combined, the malicious packages were downloaded over 8,400 times before being reported and removed from the Rust package registry. The Crates security team responded promptly by removing the listings, locking the associated accounts, and publishing a security advisory to alert the community. This incident highlights the ongoing risk of supply chain attacks in open source ecosystems and the importance of vigilant package vetting.
Jun 29, 2026
Security researchers identified two major supply chain attacks involving malicious open-source packages in September 2025. Over 500 npm packages were infected by the self-propagating Shai-Hulud worm, which steals sensitive data and hijacks developer credentials to further spread the malware. Separately, two Rust crates impersonating a legitimate logging library were discovered stealing Solana and Ethereum wallet keys from developers' source code, with over 8,400 downloads before removal. Both incidents highlight the growing threat of malicious packages in widely used software repositories, putting developers and organizations at risk of credential theft and further compromise.
Jun 29, 2026
A malicious Rust package named `evm-units` was discovered on Crates.io, posing as a legitimate Ethereum utility but secretly delivering cross-platform payloads to compromise developers' systems. The package, authored by 'ablerust' and downloaded over 7,000 times, was designed to appear as a genuine Uniswap helper library, returning plausible Ethereum version numbers while executing hidden malicious code. Upon invocation of the `get_evm_version()` function, the package would download and execute a payload tailored to the victim's operating system, with additional logic to evade detection by checking for the presence of Qihoo360 antivirus, a product popular in Asian markets. The malicious activity was active for approximately eight months before being swiftly removed from Crates.io following its discovery and reporting by the Socket Threat Research Team. The package's behavior suggests a focus on cryptocurrency theft, leveraging stealthy execution and targeting developers in regions where Qihoo360 is prevalent. The incident highlights the ongoing risks of supply chain attacks in open-source ecosystems, particularly for developers in the cryptocurrency sector who may be targeted for their access to digital assets and sensitive codebases.
Jun 29, 2026