Malicious code in logs_update (crates.io)

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

logs-update is a malicious crate published to crates.io on 2026-09-10 with zero downloads. It pretends to be a terminal progress-bar library, but renders nothing to a terminal. The whole crate steals files and sets up remote access. The crate has no build script, so it does not run during `cargo build` of a dependent. It runs when someone runs its binary (for example after `cargo install logs-update`) or when a dependent calls its run() function. When it runs, it does four things: 1. It POSTs a machine fingerprint (username, OS, and local IP) to https://rust-api-jet.vercel.app/api/validate/system-info. 2. It reads the project's .env and its trading-bot config files and POSTs them to https://rust-api-jet.vercel.app/api/validate/project-env. 3. It walks the filesystem and POSTs the contents of .env, .json, .txt, .doc, .docx, and .xlsx files to https://rust-api-jet.vercel.app/api/validate/files. 4. On Linux, it appends an attacker's SSH public key to ~/.ssh/authorized_keys, giving the attacker remote login as that user. The crate targets crypto trading-bot developers: it hunts Polymarket order-book client configs, and those developers keep exchange API keys and wallet secrets in their .env files. Every version is malicious. Attacker SSH public key appended to ~/.ssh/authorized_keys (comment [email protected]): ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDGheept5OU9//Jp0Zfq3F49s8sqkq7k6n4DA43N/DKgXz3qsQduaCHwdRmHKnx+y3SGaCGl3zlwYh5P+IO3TDfhnfPeEcIabTfHGSwJCzWF155gePLEHE1ClcZqDkMCKKJk9QumEj+5fM1LKWwx2OA+zhegm06pDpn7+6rJk6yOIXauHlnRrELlC6R/nxCAIPtA8988cbRMA6g2gqpWnbgN5NZgcT5+2RB8yZJ6uEk0IG/HrdbxYiOVMF+GTJjMmeiTMskstLlv1DHTT25BiTRA8N8l26bS5KLD7gS0dM+//G/DrcpQ89485gqOO8oZKJsagG78ez20CO6t+1A6vcBoEJljonP8S72g/cYPdB9SofHSCRPOImNXy/wwHMzOKeQrpAn2MbY3evUNPt4Tx/2eXpP1t+0P+3aLIO6MbDq7pHYAwHP54Tj5HFFbOLEcG3e5BmM4h5m5ZCa0+tsb6Jpkf7okFeEuY3NOcr1JdvmrKMPsLMsSZTb0QOJFmK4dA0S95PRtMPTut5zfKg6gznMhwl8pl8Vfdf0a62TTrmDGTvYPVUh+QtFupyjqHa3LU1s0V53btWzqtTxVSjYj2qxTfuZ1ZSOegDwQtxvMDxf5EJvt02mSZ8zRqxwVYtPn6dofrkE4Kl0eYL/4eYuO5bvZfOns/XYTC4bjt7V/j0SOQ== [email protected]

Source published

11 Sep 2026 00:00:00 UTC

Source modified

15 Sep 2026 06:00:04 UTC

Saved here

24 Oct 2026 13:19:54 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.