MAL-2026-19201: Malicious code in hesk (crates.io)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (83716a1c499cecbd64fe45f5ff56ab70ea6d1543e922c55e0514f2e2a69fe391) The crate ships two reachable async payloads — pub async fn dat in src/test.rs and pub async fn bs in src/parse.rs, both imported from src/lib.rs — that walk the user's home directory with walkdir, build a zip archive via zip::ZipWriter including wallet artefacts (e.g. exodus.wallet), and upload the archive via reqwest multipart to a hardcoded Telegram Bot API endpoint using embedded API token and chatid constants. Both payload files (parse.rs ~40KB, test.rs ~60KB) are padded with roughly a hundred nonsense filler functions with invented identifiers (Modemir65, mixwisp30, Flagzelk147, shufflezelkvak73, etc.) surrounding the exfiltration functions at the end of each file, consistent with deliberate camouflage. The dependency set — evdev and rdev (keyboard capture), winreg plus winapi winuser/processthreadsapi/memoryapi (Windows registry and process/memory primitives), walkdir, zip, and reqwest with the multipart feature — extends the capability surface to cross-platform keylogging and Windows persistence. The crate description Это учебный проект для тестирования кибербезопасности ("educational project for cybersecurity testing") does not match the shipped behavior.
Affected Software
Event History
Frequently Asked Questions
What data can the package collect and exfiltrate?
The reachable payloads walk the user's home directory and create a ZIP archive. The source specifically identifies wallet artifacts such as exodus.wallet among the files targeted for collection.
How is collected data sent out?
The payloads use reqwest multipart uploads to a hardcoded Telegram Bot API endpoint. The API token and chat ID are embedded as constants in the crate.
What needs to happen for the malicious behavior to run?
The crate contains two reachable async functions, dat in src/test.rs and bs in src/parse.rs, and both are imported from src/lib.rs. The provided data does not identify any additional trigger or input requirement.
Are there indications of functionality beyond file collection?
The dependency set includes evdev and rdev, described as supporting cross-platform keyboard capture, as well as Windows registry and process/memory APIs associated with Windows persistence capability. The confirmed payload behavior described is home-directory collection, ZIP creation, and Telegram upload.
Is the malicious code obvious during source review?
The two payload files are described as being padded with roughly a hundred nonsense filler functions surrounding the exfiltration functions. This camouflage makes the malicious routines less conspicuous in large source files.