Briefing
A critical supply chain attack has been identified within the Rust programming ecosystem, where malicious crates, faster_log and async_println , impersonated the legitimate fast_log library to compromise developer environments. These fraudulent packages were designed to scan Rust source files for Solana and Ethereum private keys, exfiltrating them to an attacker-controlled command and control (C2) server. This incident highlights the persistent vulnerability of software supply chains, impacting potentially thousands of developer systems and exposing sensitive cryptographic assets to unauthorized access. The malicious crates were downloaded 8,424 times before their removal, indicating a significant exposure window for targeted developers.
Context
The digital asset security landscape is increasingly exposed to sophisticated supply chain attacks that target the foundational software components used by developers. Prior to this incident, the industry observed a growing trend of attackers leveraging seemingly innocuous dependencies to inject malware, aiming to compromise developer workstations and continuous integration (CI) pipelines. This attack vector exploits the inherent trust in open-source package repositories, where developers often integrate third-party libraries without exhaustive security vetting, creating a fertile ground for stealthy credential harvesting operations.
Analysis
The attack vector involved typosquatting, where threat actors published two malicious Rust crates, faster_log and async_println , under aliases rustguruman and dumbnbased , mimicking the popular fast_log logging library. These crates included functional logging code as a decoy, while embedding a “packer” module designed to recursively scan Rust source files for specific patterns indicative of Solana and Ethereum private keys. Upon detection, the malware exfiltrated the identified keys, along with their file paths and line numbers, via HTTP POST requests to a hardcoded C2 endpoint, https://mainnet solana-rpc-pool workers dev/ , disguised as a legitimate Solana RPC service. The malicious code executed at runtime, impacting any environment with a Rust toolchain and outbound network access, including Linux, macOS, and Windows systems.
Parameters
- Targeted Ecosystem → Rust Programming Language
- Attack Vector → Software Supply Chain Compromise (Typosquatting)
- Vulnerability → Malicious Rust Crates ( faster_log , async_println )
- Exploited Mechanism → Runtime scanning and exfiltration of private keys
- Affected Blockchains → Solana, Ethereum
- Total Downloads (Malicious Crates) → 8,424
- Exfiltration Endpoint → https://mainnet solana-rpc-pool workers dev/
- Publication Date of Malicious Crates → May 25, 2025
- Discovery Date → September 24-25, 2025
Outlook
Immediate mitigation requires developers to remove any installations of faster_log or async_println and to rotate all secrets potentially exposed in source code, test fixtures, or configuration files. This incident underscores the imperative for enhanced supply chain security, including rigorous package vetting, real-time dependency scanning, and strict egress controls in development and CI environments. The industry must anticipate similar typosquatting campaigns across various programming ecosystems, with attackers likely to evolve their obfuscation techniques and C2 infrastructure. Proactive measures, such as implementing file-level secret scanning and adopting a zero-trust model for package consumption, are crucial to fortify defenses against these pervasive threats.
