Cybersecurity researchers have discovered two malicious Rust crates impersonating a legitimate library called fast_log to steal Solana and Ethereum wallet keys from source code.
The crates, named faster_log and async_println, were published by the threat actor under the alias rustguruman and dumbnbased on May 25, 2025, amassing 8,424 downloads in total, according to software supply chain security company Socket.
“The crates include working logging code for cover and embed routines that scan source files for Solana and Ethereum private keys, then exfiltrate matches via HTTP POST to a hardcoded command and control (C2) endpoint,” security researcher Kirill Boychenko said.
Following responsible disclosure, the maintainers of crates.io have taken steps to remove the Rust packages and disable the two accounts. It has also preserved logs of the threat actor-operated users along with the malicious crates for further analysis.
“The malicious code was executed at runtime, when running or testing a project depending on them,” Crates.io’s Walter Pearce said. “Notably, they did not execute any malicious code at build time. Except for their malicious payload, these crates copied the source code, features, and documentation of legitimate crates, using a similar name to them.”
The typosquatting attack, as detailed by Socket, involved the threat actors retaining the logging functionality of the actual library, while introducing malicious code changes during a log packing operation that recursively searched Rust files (*.rs) in a directory for Ethereum and Solana private keys and bracketed byte arrays and exfiltrate them to an Cloudflare Workers domain (“mainnet.solana-rpc-pool.workers[.]dev”).
Besides copying fast_log’s README and setting the bogus crates’ repository field to the real GitHub project, the use of “mainnet.solana-rpc-pool.workers[.]dev” is an attempt to mimic Solana’s Mainnet beta RPC endpoint “api.mainnet-beta.solana[.]com.”
According to crates.io, the two crates did not have any dependent downstream crates, nor did the users publish other crates on the Rust package registry. The GitHub accounts linked to the crates.io publisher accounts remain accessible as of writing. While the GitHub account dumbnbased was created on May 27, 2023, rustguruman did not exist until May 25, 2025 – the same day the crates were uploaded.
“This campaign shows how minimal code and simple deception can create a supply chain risk,” Boychenko said. “A functional logger with a familiar name, copied design, and README can pass casual review, while a small routine posts private wallet keys to a threat actor-controlled C2 endpoint. Unfortunately, that is enough to reach developer laptops and CI.”
Update
Both the GitHub accounts linked to the Rust crates are no longer available. Boychenko told The Hacker News that the malicious code does not get triggered during compilation or when the crates are downloaded, and that it only kicks in when the program executes and hits the relevant code paths.
“That lowers accidental exposure, but it is not ‘low risk.’ Anyone who ran code using the crates could have leaked sensitive data,” the researcher added. “We have not found public projects that depend on these two crates, and the Rust registry lists no downstream crates. There were 8,424 downloads, which is meaningful for a smaller ecosystem like Rust, but downloads do not equal adopters.”
(The story was updated after publication to include a response from Socket and the latest status of the offending GitHub accounts.)
