Stealth Supply Chain Attack: Malicious Rust Crate Used Unpinned Dependency for Silent Payload Upgrades

A popular bioinformatics tool became the latest lure in a software supply chain attack, as threat actors targeted Rust developers with a malicious package disguised as a legitimate library. The Socket Threat Research Team uncovered two malicious crates on the Crates.io registry that masqueraded as the finch genomics tool, tricking users into downloading a sophisticated credential stealer.

The attack centered on a package named finch-rust. The legitimate library, finch, is a genomic MinHashing tool with over 67,000 downloads.

To deceive developers, the threat actor, operating under the alias “faceless,” employed a classic typosquatting technique. “The typosquat uses language-suffix naming – developers searching for ‘finch’ might assume finch-rust is the Rust-specific version”.

While the package appeared functional—mimicking the API of the real library—it contained a hidden hook. “finch-rust acts as a malware loader; it contains mostly legitimate code copied from the legitimate finch package but includes a single malicious line that loads and executes the sha-rust payload”.

The attack’s mechanism relied on a clever dependency trick. The finch-rust loader declared a dependency on another malicious package, sha-rust. Crucially, it used an unpinned version specification (“0.1”).

This allowed the attacker to silently upgrade the malware without modifying the loader itself. “The threat actor’s strategy maximizes impact: publish the malware loader with an unpinned dependency, then iterate on the payload over two weeks”. Each time a victim installed finch-rust, the package manager would automatically resolve to the latest, most aggressive version of sha-rust available.

The payload, sha-rust, evolved rapidly through eight iterations over just two weeks. Initially, it aggressively scanned the victim’s entire home directory. Later versions became stealthier, targeting only the current directory to avoid detection.

The malware hunted for sensitive credentials, specifically targeting:

• Environment Files: .env, production.env, staging.env
• Config Files: config.toml
• Identity Tokens: id.json .

“Data is exfiltrated via HTTPS POST to rust-docs-build[.]vercel[.]app/api/v1, with 100ms delays between requests to avoid detection”.

To build trust, the threat actor engaged in elaborate identity theft. They impersonated a real, active GitHub developer named “radioman,” even forking legitimate repositories to flesh out a fake profile.

“By claiming repositories under the real radioman username and using professional-looking email addresses, the threat actor created multiple layers of false legitimacy”. This social engineering aspect made the malicious packages appear trustworthy to casual inspection.

Socket reported the malicious crates to the Rust Security team, who “responded by removing it almost immediately”. However, the incident highlights the persistent risk of typosquatting in open-source ecosystems.

Related Posts:

• A Trojan in Disguise: New Python Package on PyPI Hides a Multi-Stage Malware Operation
• Github launches Python security alerts
• PyPitfall: Python’s Hidden Vulnerabilities Propagate Through 145K+ Packages