Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Faster_log and async_println key-stealing Rust crates

Malware Activity
First reported
Last updated
Happening score
H score 30
1 unique sources, 1 articles

Summary

Hide ▲

The malicious Rust crates faster_log and async_println were published to steal Solana and Ethereum private keys from source files, creating a supply-chain risk for developers and CI systems. The packages copied the look and documentation of fast_log while hiding runtime code that searched Rust files for wallet secrets. They then exfiltrated matches by HTTP POST to mainnet.solana-rpc-pool.workers[.]dev. The crates were later removed from crates.io and the publisher accounts were disabled after disclosure.

Related Happenings

Inactive maintainer account 'atiertant' hit by network compromise

Incident
H score13 First: 15.05.2026 20:10 Last: 15.05.2026 20:10 Sources 1

About this happening: The inactive maintainer account 'atiertant' for node-ipc was compromised, enabling malicious package releases that could steal credentials from downstream installation...

Open Happening

Shai-Hulud supply-chain campaign spreading via stolen CI/CD credentials

Campaign
H score56 First: 12.05.2026 14:29 Last: 12.05.2026 14:29 Sources 1

About this happening: GitHub said it removed more than 500 compromised npm packages in September 2025 and moved to harden publishing after early Shai-Hulud activity. In May 2026, researcher...

Open Happening

Lightning PyPI router_runtime.js credential-stealing payload

Malware Activity
H score29 First: 30.04.2026 19:31 Last: 30.04.2026 19:31 Sources 1

About this happening: The Lightning PyPI package was pushed in malicious versions 2.6.2 and 2.6.3 on April 30, 2026, turning a normal install into credential theft for developer and C...

Latest development: 04.05.2026 20:15

Microsoft Threat Intelligence says Defender detected and prevented the malicious `lightning==2.6.3` routine in customer environments, notified the Lightning maintainer, and warned that users who ran `import lightning` may need to rotate exposed secrets, keys, and tokens.

Open Happening

Mini Shai-Hulud SAP-related npm supply-chain campaign

Campaign
H score45 First: 29.04.2026 19:26 Last: 29.04.2026 19:26 Sources 1

About this happening: A new Mini Shai-Hulud supply-chain campaign is targeting SAP-related npm packages, putting developer and CI/CD environments at risk of credential theft and malicious p...

Latest development: 12.05.2026 11:50

Mini Shai-Hulud expands beyond the original SAP-related npm packages to compromise TanStack, UiPath, Mistral AI, OpenSearch, Guardrails AI, and DraftLab packages across npm and PyPI, with malicious payloads using router_init.js, GitHub Actions abuse, and exfiltration to filev2.getsession[.]org, api.masscan[.]cloud, or attacker-controlled GitHub repositories.

Open Happening

Malicious npm packages @automagik/genie and pgserve self-propagating malware

Malware Activity
H score37 First: 24.04.2026 11:10 Last: 24.04.2026 11:10 Sources 1

About this happening: Malicious npm packages are distributing credential-stealing malware that runs during installation and self-propagates across developer ecosystems, raising supply-chain...

Open Happening

Timeline

  1. 25.09.2025 10:59 1 articles · 9mo ago

    Malicious Rust crates published with wallet-key theft

    Exploitation Observed

    The malicious Rust crates faster_log and async_println were published on crates.io under the aliases rustguruman and dumbnbased on May 25, 2025. The packages impersonated fast_log, kept logging functionality as cover, and added runtime code that scanned Rust source files for Solana and Ethereum private keys before exfiltrating matches to mainnet.solana-rpc-pool.workers[.]dev via HTTP POST.

    Show sources
    Open in new tab
  2. 25.09.2025 10:59 2 articles · 9mo ago

    Researchers detail key-stealing typosquatting and crates.io takedown

    Technical Analysis Update

    Cybersecurity researchers disclosed that faster_log and async_println copied fast_log's source code, features, README, and repository field to disguise a typosquatting campaign against developers and CI systems. The analysis said the crates executed malicious code at runtime, recursively searched Rust files (*.rs) for Solana and Ethereum private keys and bracketed byte arrays, and crates.io removed the packages and disabled the two publisher accounts after responsible disclosure.

    Show sources
    Open in new tab