Malicious Rust “evm-units” Impersonator Deploys OS-Specific Payloads
A malicious Rust crate, known as evm-units , has been identified as delivering silent, OS-specific payloads to developer machines. Authored by "ablerust," this package was available on Crates.io for approximately eight months, accumulating over 7,000…
A malicious Rust crate, known as evm-units , has been identified as delivering silent, OS-specific payloads to developer machines. Authored by "ablerust," this package was available on Crates.io for approximately eight months, accumulating over 7,000 downloads before its removal following a report from the Socket Threat Research Team.
Initially, evm-units appeared to provide a benign function, get_evm_version() , which returns an Ethereum Virtual Machine (EVM) version number. However, this function triggers a cross-platform loader that fetches and executes payloads based on the victim's operating system and the presence of Qihoo 360 antivirus software.
The malicious functionality begins with the invocation of get_evm_version() . It decodes a base64-encoded string into a remote URL utilized by an asynchronous check() function. This URL, flagged as malicious, serves as the delivery point for the second-stage script.
Linux: The malware downloads a script to the system temp directory as /tmp/init , executing it in the background using nohup bash without user alerts. macOS: A similar process occurs, saving the payload in the temp directory and executing it with osascript , enabling a silent AppleScript-based second stage. Windows: The payload is dropped as a PowerShell script ( init.ps1 ) in the temp directory. If Qihoo 360 is absent, it generates a VBScript to launch the PowerShell script stealthily.
A malicious Rust crate, known as evm-units , has been identified as delivering silent, OS-specific payloads to developer machines.
The use of danger_accept_invalid_certs(true) allows attackers to use self-signed certificates, facilitating infrastructure rotation with minimal detection.
Crypto-focused Supply Chain Compromise
The explicit check for Qihoo 360 antivirus suggests a regional focus, aligning with a cryptocurrency-theft profile. The combination of EVM-themed utilities and cross-platform loader behavior indicates targeting of crypto developers or infrastructure.
Security teams are advised to treat open-source dependencies as attack surfaces, scanning for hidden behaviors such as OS-specific downloads and script execution. Integrating automated dependency protection into CI/CD pipelines can help block malicious crates before production deployment.
The risk is compounded by another package from the same author, uniswap-utils , which depends on evm-units and invokes evm_units::get_evm_version() automatically, exemplifying a software supply chain compromise.
This incident highlights the increasing sophistication of open-source malware, particularly within cryptocurrency ecosystems, where seemingly benign functions can conceal complex malicious loaders.
Based on reporting by GBHackers.