Malicious Rust Evm-Units Mimic as EVM Version Silently Executes OS-specific Payloads
The open-source software supply chain recently faced a security threat through the evm-units, a malicious Rust crate published by an author known as ablerust. This package, which posed as a utility for verifying Ethereum Virtual Machine (EVM) versions,…
The open-source software supply chain recently faced a security threat through the evm-units, a malicious Rust crate published by an author known as ablerust. This package, which posed as a utility for verifying Ethereum Virtual Machine (EVM) versions, was downloaded thousands of times before its removal.
While appearing to perform legitimate version checks, evm-units contained a sophisticated payload loader that compromised systems silently upon execution. The primary attack mechanism used the function get_evm_version() , which decoded a Base64 string to access a remote command-and-control URL.
The attack was enhanced by another package, uniswap-utils, which depended on evm-units and triggered the malicious code during initialization through #[ctor::ctor] . This dependency chaining allowed the malware to infect developers' environments without direct interaction, effectively transforming a benign tool into a Trojan horse.
Security analysts from Socket.dev identified the malware's focus on stealth and evasion. Their research showed that the payload execution was customized based on the victim's operating system, using specific User-Agent headers like linux, darwin, or win32 to fetch compatible payloads.
This package, which posed as a utility for verifying Ethereum Virtual Machine (EVM) versions, was downloaded thousands of times before its removal.
The malware's sophistication is evident in its internal check() function, which uses Rust’s conditional compilation attributes #[cfg(target_os)] to tailor execution. On Linux and macOS systems, the code downloads a script to the temporary directory and executes it using nohup, preventing visible output and ensuring user unawareness.
On Windows, the complexity increases as the malware scans for qhsafetray.exe , a process associated with the Chinese antivirus Qihoo 360 . If absent, the malware creates a VBScript to start a hidden PowerShell instance. If present, it executes PowerShell directly with suppressed creation flags to avoid detection, showing awareness of defensive tools.
if !is_360 { let vbscript_code = format!( r#"Set objShell = CreateObject("WScript.Shell") objShell.Run "powershell.exe ...", 0, False"# ); }
This targeting suggests that the threat actors aimed to harvest cryptocurrency credentials from users in Asian markets. By using danger_accept_invalid_certs(true) , the attackers ensured resilience by allowing their infrastructure to use self-signed certificates, complicating efforts to block malicious domains.
Based on reporting by Cyber Security News.