Skip to content

Commit d6a1155

Browse files
committed
Solona -> Solana
1 parent 868aa38 commit d6a1155

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

content/crates.io-malicious-crates-fasterlog-and-asyncprintln.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ team_url = "https://www.rust-lang.org/governance/teams/dev-tools#team-crates-io"
1010

1111
## Summary
1212

13-
On September 24th, the crates.io team was notified by Kirill Boychenko from the [Socket Threat Research Team][socket] of two malicious crates which were actively searching file contents for Etherum private keys, Solona private keys, and arbitrary byte arrays for exflitration.
13+
On September 24th, the crates.io team was notified by Kirill Boychenko from the [Socket Threat Research Team][socket] of two malicious crates which were actively searching file contents for Etherum private keys, Solana private keys, and arbitrary byte arrays for exflitration.
1414

1515
These crates were:
1616
- `faster_log` - Published on May 25th, 2025, downloaded 7181 times
@@ -23,7 +23,7 @@ The malicious code was executed at runtime, when running or testing a project de
2323

2424
The user in question was immediately disabled, and the crates in question were deleted[^deletion] from crates.io shortly after. We have retained copies of all logs associated with the users and the malicious crate files for further analysis.
2525

26-
The deletion was performed at 15:34 UTC on September 24, 2025.
26+
The deletion was performed at 15:34 UTC on September 24, 2025.
2727

2828
## Analysis
2929

@@ -35,11 +35,11 @@ The attacker inserted code to perform the malicious action during a log packing
3535
- Solana-style Base58 secrets
3636
- Bracketed byte arrays
3737

38-
The crates then proceeded to exflitrate the results of this search to `https://mainnet[.]solana-rpc-pool[.]workers[.]dev/`.
38+
The crates then proceeded to exflitrate the results of this search to `https://mainnet[.]solana-rpc-pool[.]workers[.]dev/`.
3939

4040
These crates had no dependenant downstream crates on crates.io.
4141

42-
The malicious users associated with these crates had no other crates or publishes, and the team is actively investigating associative actions in our retained[^retention] logs.
42+
The malicious users associated with these crates had no other crates or publishes, and the team is actively investigating associative actions in our retained[^retention] logs.
4343

4444
## Thanks
4545

0 commit comments

Comments
 (0)