RUSTSEC-2026-0483: `lwd-uri-util` was removed from crates.io for malicious code
The lwd-uri-util crate exfiltrated SSH keys, AWS credentials, and other environmental metadata and secrets when any crate using it was built.
The malicious crate had 8 versions published on 2026-11-09 approximately 12 hours before removal and had no evidence of actual usage. This crate had no dependencies on crates.io.
Thanks to Bitbison for the report.
Affected Software
Event History
Frequently Asked Questions
Who may have been exposed to this crate?
Exposure is limited to environments where a crate using lwd-uri-util was built during the period it was available. The advisory reports no evidence of actual usage, but any such build may have exposed SSH keys, AWS credentials, environmental metadata, and other secrets available to the build environment.
What action is needed if this crate was present in a build?
Treat secrets accessible during the affected build as potentially exfiltrated. In particular, rotate exposed SSH keys and AWS credentials, and review other environment-provided credentials or sensitive metadata.
Does this affect projects through transitive crates.io dependencies?
The crate had no dependencies on crates.io. The provided data does not identify any downstream crates that depended on it.