Which versions of lwd-uri-util are malicious?

The following crates.io versions of lwd-uri-util are flagged malicious: 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7. Treat any of these as compromised.

How do I remediate lwd-uri-util if I installed it?

lwd-uri-util is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed lwd-uri-util — how do I know if it already compromised me?

If lwd-uri-util was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is lwd-uri-util part of a known attack campaign?

Yes — lwd-uri-util is associated with the IN-MAL-2026-022581, IN-MAL-2026-022579, IN-MAL-2026-022580, IN-MAL-2026-022582, IN-MAL-2026-022578, IN-MAL-2026-022585, IN-MAL-2026-022584, IN-MAL-2026-022583 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find lwd-uri-util across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for lwd-uri-util (8 malicious versions).

Malicious package

lwd-uri-utilcrates.io

Advisory published Nov 10, 2026Updated Nov 10, 2026

lwd-uri-util is a confirmed malicious crates.io package (MAL-2026-19058) that steals credentials and exfiltrates sensitive data (malicious versions 0.1.0, 0.1.1, 0.1.2…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in lwd_uri_util (crates.io)

MAL-2026-19058

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

remove lwd-uri-util

What this malware does

The crate's build.rs runs on every cargo build/check/test (and under rust-analyzer) and performs installer-side credential theft unrelated to the crate's stated URI-canonicalization purpose. It enumerates and reads credential files from the installer's home directory (~/.aws/credentials, ~/.ssh/config, ~/.netrc, ~/.cargo/credentials.toml, ~/.npmrc, ~/.pypirc, ~/.git-credentials, ~/.config/gh/hosts.yml, keplr-mcp vaults, and .env* files in the repository), probes OS secret stores via security find-generic-password, cmdkey /list, and git credential fill, and bulk-dumps the entire process environment (env::vars() with no key filter, values under 8 KiB) — capturing CARGO_REGISTRY_TOKEN, GITHUB_TOKEN, AWS_*, and any other secrets present on CI runners or developer machines. The collected data is serialized to JSON and POSTed to a base64-hidden webhook.site endpoint (https://webhook.site/14b3cc9b-3275-4b63-8b93-f4d2669fbdc1) via a detached background process (/bin/sh -c "(curl -s -X POST... &)" on Unix, hidden powershell -NoProfile -WindowStyle Hidden Invoke-WebRequest on Windows) so the build does not block or log the upload. Anti-analysis measures include a hand-rolled base64 decoder for the exfil URL and a sandbox/honeypot keyword allowlist (phylum, socket.dev, sandbox, honeypot, canary, example.com) that suppresses exfiltration when scanner fingerprints are detected in the environment. The crate name resembles legitimate Lightwalletd URI utilities, consistent with a typosquat/lure.

Malicious versions

8 flagged

0.1.00.1.10.1.20.1.30.1.40.1.50.1.60.1.7

Indicators of compromise (SHA-256)

194256cec6d17f809a9181e45a363e2548bfbf3ebf51aaa708cec543a66fdb28

724f9db76ea40c53c92dea0321c344ae31f02e0431fd85722a10db21432f4a1a

9e3b401ea4e0938e11896a54c78c8d9913492f16d8d0ce6153206ac60d85ff1c

c264773551538df399c756c4487381053b555fe2db77d0b23a0fbb9eef3f0915

e81c03febf0e971e3e3442e9e9d7987d297c951f84990ea3bfa68edc8e05e544

3d8a38ce1c03731cf228da2312278e811eb1abd043654506e223a3465b591e5f

88e054ad597970f8873dd4c43ed762e151e491a2805c0a91a03c6bb8ada23c0c

912a23b9591c44a2e3f0e45acc7ec6a62051873048dbc8590ff331a11d205614

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for lwd-uri-util (8 malicious versions).
If you installed it — respond
lwd-uri-util is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If lwd-uri-util was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. lwd-uri-util on crates.io has been identified as a malicious package (versions 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-022581IN-MAL-2026-022579IN-MAL-2026-022580IN-MAL-2026-022582IN-MAL-2026-022578IN-MAL-2026-022585IN-MAL-2026-022584IN-MAL-2026-022583

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks lwd-uri-util-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database