heskcrates.io

The crate ships two reachable async payloads — pub async fn dat in src/test.rs and pub async fn bs in src/parse.rs, both imported from src/lib.rs — that walk the user's home directory with walkdir, build a zip archive via zip::ZipWriter including wallet artefacts (e.g. exodus.wallet), and upload the archive via reqwest multipart to a hardcoded Telegram Bot API endpoint using embedded API_ token and chat_id constants. Both payload files (parse.rs ~40KB, test.rs ~60KB) are padded with roughly a hundred nonsense filler functions with invented identifiers (Modemir65, mix_wisp_30, Flagzelk147, shuffle_zelkvak_73, etc.) surrounding the exfiltration functions at the end of each file, consistent with deliberate camouflage. The dependency set — evdev and rdev (keyboard capture), winreg plus winapi winuser/processthreadsapi/memoryapi (Windows registry and process/memory primitives), walkdir, zip, and reqwest with the multipart feature — extends the capability surface to cross-platform keylogging and Windows persistence. The crate description Это учебный проект для тестирования кибербезопасности ("educational project for cybersecurity testing") does not match the shipped behavior.