crates.io: Malicious crates faster_log and async_println | Rust Blog
Updated September 24th, 2025 17:34:38 UTC - Socket has also published their own accompanying blog post about the attack.
Summary
On September 24th, the crates.io team was notified by Kirill Boychenko from the Socket Threat Research Team of two malicious crates which were actively searching file contents for Etherum private keys, Solana private keys, and arbitrary byte arrays for exfiltration.
These crates were:
faster_log - Published on May 25th, 2025, downloaded 7181 times
async_println - Publi...
Read more at blog.rust-lang.org