New Malicious Rust Crates Impersonate fast_log to Steal Solana and Ethereum Wallet Keys

Two malicious Rust crates, disguised as the popular fast_log library, have been identified as harvesting private Solana and Ethereum keys from developers’ environments. These impostor crates incorporated legitimate logging functionalities to avoid detection while executing hidden routines that scan source files for wallet keys and exfiltrate them to a predefined command-and-control endpoint. Together, the crates amassed 8,424 downloads before their removal from crates.io.

On May 25, 2025, the threat actors uploaded faster_log version 1.7.8 and async_println version 1.0.1 to crates.io, mimicking the README, repository links, and naming conventions of the authentic fast_log package. Socket’s Threat Research Team identified the counterfeit packages, faster_log and async_println, published under the aliases rustguruman and dumbnbased. Socket’s AI Scanner flagged faster_log as known malware due to typosquatting indicators and the presence of exfiltration code.

Following Socket's report, Crates.io security, in collaboration with the Rust Security Response WG and the Rust Foundation, preserved the malicious files for analysis, removed the listings to prevent further downloads, locked the rustguruman and dumbnbased publisher accounts, and issued an advisory detailing their investigation and remediation actions.

The crates, despite functioning as basic logging libraries, contained a "packer" module that:

Scans Rust source files for specific patterns:

Bracketed byte arrays potentially encoding raw key material. Quoted Base58 strings of 32–44 characters, aligning with Solana key formats. Quoted 0x-prefixed 64-hex strings, typical of Ethereum private keys.

Packages each match with its type, exact value, file path, and line number into a JSON payload. Transmits the payload via an HTTP POST request to a Cloudflare Workers subdomain, styled as a Solana RPC endpoint.

The malicious crates, relying solely on standard libraries and the popular reqwest HTTP client, operate uniformly across Linux, macOS, and Windows, running both during application runtime and within CI pipelines. The attackers enhanced acceptance by replicating the legitimate fast_log’s metadata and maintaining core logging behaviors.

This incident underscores the increasing risk of supply-chain attacks facilitated by minimal code changes and name impersonation. Organizations should address this as a supply-chain security incident and take the following immediate actions:

Remove installations of faster_log or async_println from projects and build systems, and suspend any related CI runs. Rotate secrets that might appear in source repositories, test fixtures, or configuration files, including Ethereum private keys, Solana seeds, and other credentials as quoted strings or byte arrays. Implement file-level secret scanning on developer laptops, CI servers, and repository hosting systems to detect patterns observed in this campaign. Restrict egress traffic from development and CI networks to trusted outbound destinations only. Create detection rules for HTTP POSTs to unusual endpoints containing JSON payloads with key-harvest patterns.

To guard against future impostor packages, security teams can deploy multi-layered solutions:

Real-time pull-request scanning with tools like the Socket GitHub App to flag malicious code before merges. Pre-installation checks using CLI scanners that alert on impersonation and risky behavior. Browser extensions to annotate crates.io pages, highlighting suspicious metadata and typosquatting attempts. AI-assisted coding protections to intercept malicious package suggestions from language models and IDE plugins.

As ecosystems evolve, attackers will refine techniques, embedding malicious logic in build scripts or macros, rotating C2 endpoints, and leveraging geofencing to blend exfiltration with normal RPC traffic. Vigilance, strict secret hygiene, and layered defense-in-depth remain crucial to securing modern development supply chains.

Based on reporting by GBHackers.