lwd_uri_util (crates.io): malicious build.rs steals env credentials from release/publishing workstations (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
The crates.io crate lwduriutil, advertised as a URI canonicalization utility, contains malicious code in build.rs across all published versions (0.1.0–0.1.4). The lib.rs is benign string manipulation, but build.rs runs on every cargo build/check/IDE load, dumps the full process environment plus hostname and username to JSON, and POSTs it via curl (Unix) or hidden PowerShell (Windows) to three base64-obfuscated endpoints including webhook.site and a Cloudflare Worker tied to the author's handle. Gating markers (FASTLANE, APPLEID, KEYSTORE, CODESIGN, etc.) target release/signing workstations while suppressing CI usernames, aiming to capture CARGOREGISTRYTOKEN, GITHUBTOKEN, AWS credentials and signing material. No patched version exists; the crate should be treated as compromised and removed.
What to do
- Remove lwd_uri_util from all dependency trees and purge Cargo.lock references
- Rotate CARGO_REGISTRY_TOKEN, GITHUB_TOKEN, AWS and signing/keystore credentials on any machine that built the crate
- Audit build machines for signs of exfiltration and re-secure release/publishing environments
- Block the exfiltration domains (api.sdklfghaljksdhfkjasdfhlasdhfjklasdf.xyz, webhook.site/0a60608b-63de-480c-a441-38a8d107a9ea, session-check.sapho11.workers.dev)
- Pin and review build.rs scripts of third-party crates before building
Sources
All live incidents on Threat Watch
