MAL-2026-19058

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/crates.io/lwd_uri_util/MAL-2026-19058.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-19058
Published
2026-11-10T05:07:11Z
Modified
2026-11-10T06:45:03Z
Summary
Malicious code in lwd_uri_util (crates.io)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (912a23b9591c44a2e3f0e45acc7ec6a62051873048dbc8590ff331a11d205614)

The crate's build.rs runs on every cargo build/check/test (and under rust-analyzer) and performs installer-side credential theft unrelated to the crate's stated URI-canonicalization purpose. It enumerates and reads credential files from the installer's home directory (~/.aws/credentials, ~/.ssh/config, ~/.netrc, ~/.cargo/credentials.toml, ~/.npmrc, ~/.pypirc, ~/.git-credentials, ~/.config/gh/hosts.yml, keplr-mcp vaults, and .env* files in the repository), probes OS secret stores via security find-generic-password, cmdkey /list, and git credential fill, and bulk-dumps the entire process environment (env::vars() with no key filter, values under 8 KiB) — capturing CARGO_REGISTRY_TOKEN, GITHUB_TOKEN, AWS_*, and any other secrets present on CI runners or developer machines. The collected data is serialized to JSON and POSTed to a base64-hidden webhook.site endpoint (https://webhook.site/14b3cc9b-3275-4b63-8b93-f4d2669fbdc1) via a detached background process (/bin/sh -c "(curl -s -X POST... &)" on Unix, hidden powershell -NoProfile -WindowStyle Hidden Invoke-WebRequest on Windows) so the build does not block or log the upload. Anti-analysis measures include a hand-rolled base64 decoder for the exfil URL and a sandbox/honeypot keyword allowlist (phylum, socket.dev, sandbox, honeypot, canary, example.com) that suppresses exfiltration when scanner fingerprints are detected in the environment. The crate name resembles legitimate Lightwalletd URI utilities, consistent with a typosquat/lure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022581",
            "import_time": "2026-11-10T05:12:34.451395275Z",
            "modified_time": "2026-11-10T05:07:33Z",
            "sha256": "194256cec6d17f809a9181e45a363e2548bfbf3ebf51aaa708cec543a66fdb28",
            "source": "amazon-inspector",
            "versions": [
                "0.1.3"
            ]
        },
        {
            "id": "IN-MAL-2026-022579",
            "import_time": "2026-11-10T05:12:34.378870241Z",
            "modified_time": "2026-11-10T05:07:19Z",
            "sha256": "724f9db76ea40c53c92dea0321c344ae31f02e0431fd85722a10db21432f4a1a",
            "source": "amazon-inspector",
            "versions": [
                "0.1.4"
            ]
        },
        {
            "id": "IN-MAL-2026-022580",
            "import_time": "2026-11-10T05:12:34.418653948Z",
            "modified_time": "2026-11-10T05:07:27Z",
            "sha256": "9e3b401ea4e0938e11896a54c78c8d9913492f16d8d0ce6153206ac60d85ff1c",
            "source": "amazon-inspector",
            "versions": [
                "0.1.2"
            ]
        },
        {
            "id": "IN-MAL-2026-022582",
            "import_time": "2026-11-10T05:12:34.483918722Z",
            "modified_time": "2026-11-10T05:07:42Z",
            "sha256": "c264773551538df399c756c4487381053b555fe2db77d0b23a0fbb9eef3f0915",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-022578",
            "import_time": "2026-11-10T05:12:34.275849742Z",
            "modified_time": "2026-11-10T05:07:11Z",
            "sha256": "e81c03febf0e971e3e3442e9e9d7987d297c951f84990ea3bfa68edc8e05e544",
            "source": "amazon-inspector",
            "versions": [
                "0.1.1"
            ]
        },
        {
            "id": "IN-MAL-2026-022585",
            "import_time": "2026-11-10T06:40:32.612686279Z",
            "modified_time": "2026-11-10T06:34:48Z",
            "sha256": "3d8a38ce1c03731cf228da2312278e811eb1abd043654506e223a3465b591e5f",
            "source": "amazon-inspector",
            "versions": [
                "0.1.5"
            ]
        },
        {
            "id": "IN-MAL-2026-022584",
            "import_time": "2026-11-10T06:40:32.51550387Z",
            "modified_time": "2026-11-10T06:34:40Z",
            "sha256": "88e054ad597970f8873dd4c43ed762e151e491a2805c0a91a03c6bb8ada23c0c",
            "source": "amazon-inspector",
            "versions": [
                "0.1.6"
            ]
        },
        {
            "id": "IN-MAL-2026-022583",
            "import_time": "2026-11-10T06:40:32.323642606Z",
            "modified_time": "2026-11-10T06:34:32Z",
            "sha256": "912a23b9591c44a2e3f0e45acc7ec6a62051873048dbc8590ff331a11d205614",
            "source": "amazon-inspector",
            "versions": [
                "0.1.7"
            ]
        }
    ]
}
References
Credits

Affected packages

crates.io / lwd-uri-util

Package

Name
lwd-uri-util
View open source insights on deps.dev
Purl
pkg:cargo/lwd-uri-util

Affected ranges

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "build.rs",
            "sha256": "a2bdc4c20f189c6be6956e467678f8a2a539fc9bc26fc9ce591125c010ba52b7",
            "tlsh": "ccb1d9d77160743d16b2936c8b66a240ff15512f41a0921db97e43186fff9a881f1fc4"
        }
    ],
    "package_integrity": [
        {
            "filename": "lwd-uri-util-0.1.3.crate",
            "hashes": {
                "sha256": "80c54ff4fe231c363db0c75cbb81f566ea4d10c266ec594165d840df13ab0973"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/crates.io/lwd_uri_util/MAL-2026-19058.json"