A malicious Rust package (evm-units) was live on Crates.io for 8 months, hiding RCE in a version check function. The loader uses VBScript and checks for Qihoo360 to compromise crypto developers on Windows/Linux/macOS.
A malicious Rust package (evm-units) was live on Crates.io for 8 months, hiding RCE in a version check function. The loader uses VBScript and checks for Qihoo360 to compromise crypto developers on Windows/Linux/macOS.