MAL-2026-19058: Malicious code in lwd_uri_util (crates.io)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (e81c03febf0e971e3e3442e9e9d7987d297c951f84990ea3bfa68edc8e05e544) The crate is advertised as a URI canonicalization utility, and lib.rs is pure string manipulation with no network I/O. However, build.rs executes on every cargo build/check/IDE load and performs installer-side credential theft. It enumerates the full process environment via env::vars() with no key filtering, appends hostname and username, serializes the result to a JSON file under OUTDIR, and POSTs it via a detached /bin/sh -c "(curl -s -X POST... --data-binary @...)" on Unix and a hidden powershell iwr -Method Post variant on Windows. The three destination URLs are stored as base64 literals and decoded at runtime: api.sdklfghaljksdhfkjasdfhlasdhfjklasdf.xyz, webhook.site/0a60608b-63de-480c-a441-38a8d107a9ea, and session-check.sapho11.workers.dev (the sapho11 handle matches the crate's Cargo repository field). Reporting is gated by base64-encoded environment-variable markers that select release/publishing workstations — VINOR, MATCH, FASTLANE, APPLEID, SPARKLE, ANDROIDKEYSTORE, KEYSTORE, PLAYPUBLISHER, SIGNINGCERT, CODESIGN, DEVELOPERDIR, KEYCHAIN — while suppressing generic CI-runner usernames (runner, root, github, actions, circleci, travis, jenkins, codespace). Env scraping on these hosts routinely captures CARGOREGISTRYTOKEN, GITHUBTOKEN, AWS, signing-certificate variables, and keystore paths, enabling downstream code-signing and package-publishing compromise.
Affected Software
Event History
Frequently Asked Questions
Which development workflows can trigger the behavior?
The build script runs during cargo build, cargo check, and IDE loads. Exposure can therefore occur before the crate is used at runtime.
What information may be sent from an affected workstation?
The script enumerates the full process environment without filtering, then adds the hostname and username. It serializes this information to a JSON file under OUT_DIR before attempting to transmit it.
What conditions are required for transmission?
Reporting is gated on base64-encoded environment-variable markers associated with release and publishing workstations, including VINOR_, MATCH_, FASTLANE_, APPLE_ID, SPARKLE_, ANDROID_KEYSTORE, and KEYSTORE_. Systems with matching environment variables are the specifically targeted population.
How can teams investigate possible exposure?
Review build-time network activity from cargo build, cargo check, and IDE processes for requests to api.sdklfghaljksdhfkjasdfhlasdhfjklasdf.xyz, webhook.site/0a60608b-63de-480c-a441-38a8d107a9ea, or session-check.sapho11.workers.dev. On Unix, the request is launched through a detached /bin/sh command using curl; on Windows, it uses a hidden PowerShell iwr command.