{"id":"MAL-2026-19200","summary":"Malicious code in basek (crates.io)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f82b1f071f557e9f25cfce6d7643f19053c6a2bd7d61470fcf114ac53e950c63)\nbasek 0.1.0 is a Windows keylogger shipped as a Rust library. The exposed get_data() routine polls Windows key states for alphanumeric, function, and special keys and batches captured keystrokes together with the local username. The batches are POSTed to the Telegram Bot API at api.telegram.org/bot\u003ctoken\u003e/sendMessage using a bot token stored as a byte array XORed with 0xAA and reassembled at runtime via the ut! macro, with hardcoded chat_id 7304091279; a secondary exfiltration endpoint https://keylogger.nullsect0r.tech/log is also configured. The crate installs itself for persistence: ensure_installed() copies the host binary to %LOCALAPPDATA%\\WindowsSystemUtility\\WinSysUtils.exe, writes an HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run value named 'WinSysUtils' for boot persistence, spawns a watchdog clone under a random 12-digit filename to respawn the keylogger, and schedules a cmd.exe timeout+del sequence to self-delete the original. A 30-second initial sleep, a 20-second warmup during which keystrokes are observed but not logged, and randomized polling jitter are used to evade sandbox and behavioral analysis. The crate description's 'educational cybersecurity project' framing is contradicted by the XOR-obfuscated exfiltration destination, hardcoded attacker chat_id, Run-key persistence, watchdog respawn, and self-delete logic.\n","modified":"2026-11-12T22:15:03.354624359Z","published":"2026-11-12T21:47:36Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022652","import_time":"2026-11-12T22:10:48.52414254Z","modified_time":"2026-11-12T21:47:36Z","sha256":"f82b1f071f557e9f25cfce6d7643f19053c6a2bd7d61470fcf114ac53e950c63","source":"amazon-inspector","versions":["0.1.0"]}]},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/basek/0.1.0"}],"affected":[{"package":{"name":"basek","ecosystem":"crates.io","purl":"pkg:cargo/basek"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/crates.io/basek/MAL-2026-19200.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"basek-0.1.0.crate","hashes":{"sha256":"a566084b69d04589f430f1b42b681df5ff86c7c681dd5370c00e4acf843709f7"}}],"evidence_files":[{"tlsh":"2e9264569a96112c6db3b87e0b9fe13337e5a12be4168d21390c4f887f9501885fc3e3","path":"src/lib.rs","sha256":"296b7f456bf4eb4b1bfc8aff26af19b0b08d3fd12571c2fa41ea5ec0c8cf69c4"}]}}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}