{"id":"MAL-2026-19058","summary":"Malicious code in lwd_uri_util (crates.io)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (912a23b9591c44a2e3f0e45acc7ec6a62051873048dbc8590ff331a11d205614)\nThe crate's build.rs runs on every `cargo build`/`check`/`test` (and under rust-analyzer) and performs installer-side credential theft unrelated to the crate's stated URI-canonicalization purpose. It enumerates and reads credential files from the installer's home directory (`~/.aws/credentials`, `~/.ssh/config`, `~/.netrc`, `~/.cargo/credentials.toml`, `~/.npmrc`, `~/.pypirc`, `~/.git-credentials`, `~/.config/gh/hosts.yml`, keplr-mcp vaults, and `.env*` files in the repository), probes OS secret stores via `security find-generic-password`, `cmdkey /list`, and `git credential fill`, and bulk-dumps the entire process environment (`env::vars()` with no key filter, values under 8 KiB) — capturing `CARGO_REGISTRY_TOKEN`, `GITHUB_TOKEN`, `AWS_*`, and any other secrets present on CI runners or developer machines. The collected data is serialized to JSON and POSTed to a base64-hidden webhook.site endpoint (`https://webhook.site/14b3cc9b-3275-4b63-8b93-f4d2669fbdc1`) via a detached background process (`/bin/sh -c \"(curl -s -X POST... &)\"` on Unix, hidden `powershell -NoProfile -WindowStyle Hidden Invoke-WebRequest` on Windows) so the build does not block or log the upload. Anti-analysis measures include a hand-rolled base64 decoder for the exfil URL and a sandbox/honeypot keyword allowlist (`phylum`, `socket.dev`, `sandbox`, `honeypot`, `canary`, `example.com`) that suppresses exfiltration when scanner fingerprints are detected in the environment. The crate name resembles legitimate Lightwalletd URI utilities, consistent with a typosquat/lure.\n","modified":"2026-11-10T06:45:03.086418449Z","published":"2026-11-10T05:07:11Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-11-10T05:12:34.451395275Z","modified_time":"2026-11-10T05:07:33Z","sha256":"194256cec6d17f809a9181e45a363e2548bfbf3ebf51aaa708cec543a66fdb28","source":"amazon-inspector","versions":["0.1.3"],"id":"IN-MAL-2026-022581"},{"import_time":"2026-11-10T05:12:34.378870241Z","modified_time":"2026-11-10T05:07:19Z","sha256":"724f9db76ea40c53c92dea0321c344ae31f02e0431fd85722a10db21432f4a1a","source":"amazon-inspector","versions":["0.1.4"],"id":"IN-MAL-2026-022579"},{"source":"amazon-inspector","versions":["0.1.2"],"id":"IN-MAL-2026-022580","import_time":"2026-11-10T05:12:34.418653948Z","modified_time":"2026-11-10T05:07:27Z","sha256":"9e3b401ea4e0938e11896a54c78c8d9913492f16d8d0ce6153206ac60d85ff1c"},{"versions":["0.1.0"],"id":"IN-MAL-2026-022582","import_time":"2026-11-10T05:12:34.483918722Z","modified_time":"2026-11-10T05:07:42Z","sha256":"c264773551538df399c756c4487381053b555fe2db77d0b23a0fbb9eef3f0915","source":"amazon-inspector"},{"sha256":"e81c03febf0e971e3e3442e9e9d7987d297c951f84990ea3bfa68edc8e05e544","source":"amazon-inspector","versions":["0.1.1"],"id":"IN-MAL-2026-022578","import_time":"2026-11-10T05:12:34.275849742Z","modified_time":"2026-11-10T05:07:11Z"},{"versions":["0.1.5"],"id":"IN-MAL-2026-022585","import_time":"2026-11-10T06:40:32.612686279Z","modified_time":"2026-11-10T06:34:48Z","sha256":"3d8a38ce1c03731cf228da2312278e811eb1abd043654506e223a3465b591e5f","source":"amazon-inspector"},{"versions":["0.1.6"],"id":"IN-MAL-2026-022584","import_time":"2026-11-10T06:40:32.51550387Z","modified_time":"2026-11-10T06:34:40Z","sha256":"88e054ad597970f8873dd4c43ed762e151e491a2805c0a91a03c6bb8ada23c0c","source":"amazon-inspector"},{"id":"IN-MAL-2026-022583","import_time":"2026-11-10T06:40:32.323642606Z","modified_time":"2026-11-10T06:34:32Z","sha256":"912a23b9591c44a2e3f0e45acc7ec6a62051873048dbc8590ff331a11d205614","source":"amazon-inspector","versions":["0.1.7"]}]},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/lwd-uri-util/0.1.3"},{"type":"PACKAGE","url":"https://crates.io/crates/lwd-uri-util/0.1.4"},{"type":"PACKAGE","url":"https://crates.io/crates/lwd-uri-util/0.1.2"},{"type":"PACKAGE","url":"https://crates.io/crates/lwd-uri-util/0.1.0"},{"type":"PACKAGE","url":"https://crates.io/crates/lwd-uri-util/0.1.1"},{"type":"PACKAGE","url":"https://crates.io/crates/lwd-uri-util/0.1.5"},{"type":"PACKAGE","url":"https://crates.io/crates/lwd-uri-util/0.1.6"},{"type":"PACKAGE","url":"https://crates.io/crates/lwd-uri-util/0.1.7"}],"affected":[{"package":{"name":"lwd-uri-util","ecosystem":"crates.io","purl":"pkg:cargo/lwd-uri-util"},"versions":["0.1.3","0.1.4","0.1.2","0.1.0","0.1.1","0.1.5","0.1.6","0.1.7"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"a2bdc4c20f189c6be6956e467678f8a2a539fc9bc26fc9ce591125c010ba52b7","tlsh":"ccb1d9d77160743d16b2936c8b66a240ff15512f41a0921db97e43186fff9a881f1fc4","path":"build.rs"}],"package_integrity":[{"filename":"lwd-uri-util-0.1.3.crate","hashes":{"sha256":"80c54ff4fe231c363db0c75cbb81f566ea4d10c266ec594165d840df13ab0973"}}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/crates.io/lwd_uri_util/MAL-2026-19058.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}