Two malicious software packages published on the official Rust programming language repository, Crates.io, were downloaded nearly 8,500 times before being removed. The packages were designed to scan developers' computers for private keys associated with cryptocurrency wallets and other sensitive data.
The packages, named 'faster_log' and 'async_println,' were identified by researchers at code security firm Socket. Following the report, Crates.io removed the packages and suspended the associated publisher accounts on September 24, 2025, to prevent further downloads.
Key Takeaways
- Two malicious packages, 'faster_log' and 'async_println,' were found on the official Rust repository, Crates.io.
- The packages were downloaded a combined total of nearly 8,500 times before removal.
- Their primary function was to scan systems for cryptocurrency private keys, specifically for Ethereum and Solana.
- The security firm Socket discovered the threat and reported it, leading to the packages' removal on September 24th.
- Developers who used these packages are advised to immediately move their digital assets to new, secure wallets.
Malicious Code Discovered in Official Repository
The official package registry for the Rust programming language, Crates.io, has removed two packages containing malicious code. These packages, 'faster_log' and 'async_println,' were published on May 25, 2025.
According to download statistics, 'faster_log' was downloaded approximately 7,200 times, while 'async_println' was downloaded about 1,200 times. The discovery was made by security researchers at Socket, who promptly alerted the Crates.io security team.
In response to the report, the platform took swift action. Both packages were removed from the registry, and the publisher accounts, identified as 'rustguruman' and 'dumbnbased,' were suspended to prevent them from uploading additional malicious code.
Disguised as Legitimate Tools to Steal Secrets
The attackers employed a technique known as typosquatting and impersonation to deceive developers. The malicious packages were designed to look and function like a legitimate and popular crate named 'fast_log'.
To reduce suspicion, the creators of the malicious packages copied the README file and other metadata from the genuine project. They also included the legitimate logging functionality, so the packages would appear to work as expected while secretly executing malicious tasks in the background.
What is Crates.io?
Crates.io is the central package repository for the Rust programming language, similar to npm for JavaScript or PyPI for Python. It hosts thousands of open-source libraries, known as "crates," that developers can easily integrate into their projects to add functionality without writing code from scratch.
Targeting Cryptocurrency Keys
The primary goal of the malware was to locate and steal sensitive information related to cryptocurrency wallets. The malicious code was designed to execute when a developer's project was compiled or run.
Once active, the code would scan the developer's environment and source files for specific patterns of text. It looked for three main types of data:
- Hexadecimal strings that match the format of Ethereum private keys.
- Base58 encoded strings, which are commonly used for Solana private keys and addresses.
- Bracketed byte arrays that could potentially contain cryptographic keys or secret seeds.
This targeted approach indicates the attackers were specifically interested in gaining access to digital assets held in popular blockchain wallets.
How the Data Was Stolen
When the scanning code found a potential match for a private key or other secret, it would capture the information along with its location, including the file path and line number.
This collected data was then bundled together and transmitted to a remote server controlled by the attackers. According to Socket's analysis, the exfiltration endpoint was a hardcoded URL at a Cloudflare Worker address: mainnet[.]solana-rpc-pool[.]workers[.]dev.
Exfiltration Endpoint Active
During their investigation, Socket researchers confirmed that the Cloudflare Worker endpoint was live and actively accepting data sent via POST requests. They noted that despite its name, the host is not an official Solana RPC endpoint, further confirming its malicious nature.
The use of a serverless platform like Cloudflare Workers for data exfiltration is a common tactic used by attackers to create a low-cost, difficult-to-trace collection point for stolen information.
Impact and Mitigation for Developers
Crates.io released an announcement confirming the removal of the packages. The platform also noted that the attack's scope was contained, as no other packages on the registry depended on the malicious crates. This means the malware did not spread automatically to other projects through dependencies.
Despite this, any developer who manually downloaded and integrated either 'faster_log' or 'async_println' into their projects is at risk.
"Developers who have downloaded either crate need to perform a system cleanup and move their digital assets to new wallets to prevent theft," the original report from Socket advised.
Security experts recommend that developers take immediate action if they suspect they may have used these packages. This includes a thorough review of their systems for any remaining malicious files and, most importantly, transferring all cryptocurrencies and other digital assets to new wallets with newly generated private keys.
Best Practices for Developers
This incident highlights the ongoing risk of supply chain attacks in software development. To protect against similar threats, developers are encouraged to follow security best practices:
- Verify Publisher Reputation: Before downloading a new package, check the publisher's history and reputation on the platform. Look for established accounts with a history of legitimate contributions.
- Check for Typosquatting: Carefully check the spelling of package names. Attackers often use names that are very similar to popular, legitimate packages.
- Review Package Metadata: Examine the package's repository link, documentation, and download statistics. Unusually low download counts for a package that mimics a popular one can be a red flag.
- Inspect Source Code: When possible, review the source code of new dependencies for any suspicious behavior, such as network requests to unknown URLs or file system scanning.
By remaining vigilant, developers can help secure the software supply chain and protect their projects and personal data from malicious actors.
