A Rust language developer has warned about the discovery of malicious code in the crates.io repository within the finch-rust, sha-rust, evm-units, and uniswap-utils packages.
The evm-units package included code that loaded malicious components aimed at stealing cryptocurrency. The malicious package was uploaded in April 2025 and was downloaded 7,257 times. The uniswap-utils package was also uploaded in April, downloaded 7,441 times, and used evm-units as a dependency. The malicious code was activated when the function get_evm_version() was called, leading to the download of external code from the link "https://download[.]videotalks[.]xyz/gui/6dad3/...". In Linux and macOS, an init script was downloaded and executed, while in Windows, the init.ps1 script was used.
The sha-rust package was uploaded on November 20, was downloaded 153 times, and contained code to search for and send external szerver confidential data. The finch-rust package included original code from the finch package, with a call to the function "sha_rust::from_str()" that executed an obfuscated handler sending system information, environment variables, and the contents of config.toml, id.json, and files with the extension ".env" (e.g., production.env, staging.env, and dev.env with access tokens) to the server "https://rust-docs-build[.]vercel[.]app/api/v1".
On November 25, the finch-rust package was also uploaded to crates.io, using sha-rust as a dependency and created for a type-squatting attack on users of the legitimate finch package, expecting that users would not notice the difference in the name when finding the package through searches or selections from lists.
Forrás: opennet.ru
