You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
On September 24th, the crates.io team was notified by Kirill Boychenko from the [Socket Threat Research Team][socket] of two malicious crates which were actively searching file contents for Etherum private keys, Solona private keys, and arbitrary byte arrays for exflitration.
13
+
On September 24th, the crates.io team was notified by Kirill Boychenko from the [Socket Threat Research Team][socket] of two malicious crates which were actively searching file contents for Etherum private keys, Solana private keys, and arbitrary byte arrays for exflitration.
14
14
15
15
These crates were:
16
16
-`faster_log` - Published on May 25th, 2025, downloaded 7181 times
@@ -23,7 +23,7 @@ The malicious code was executed at runtime, when running or testing a project de
23
23
24
24
The user in question was immediately disabled, and the crates in question were deleted[^deletion] from crates.io shortly after. We have retained copies of all logs associated with the users and the malicious crate files for further analysis.
25
25
26
-
The deletion was performed at 15:34 UTC on September 24, 2025.
26
+
The deletion was performed at 15:34 UTC on September 24, 2025.
27
27
28
28
## Analysis
29
29
@@ -35,11 +35,11 @@ The attacker inserted code to perform the malicious action during a log packing
35
35
- Solana-style Base58 secrets
36
36
- Bracketed byte arrays
37
37
38
-
The crates then proceeded to exflitrate the results of this search to `https://mainnet[.]solana-rpc-pool[.]workers[.]dev/`.
38
+
The crates then proceeded to exflitrate the results of this search to `https://mainnet[.]solana-rpc-pool[.]workers[.]dev/`.
39
39
40
40
These crates had no dependenant downstream crates on crates.io.
41
41
42
-
The malicious users associated with these crates had no other crates or publishes, and the team is actively investigating associative actions in our retained[^retention] logs.
42
+
The malicious users associated with these crates had no other crates or publishes, and the team is actively investigating associative actions in our retained[^retention] logs.
0 commit comments