New Malicious Rust Crates Impersonate fast_log to Steal Solana and Ethereum Wallet Keys

A pair of malicious Rust crates masquerading as the popular fast_log library have been uncovered, harvesting private Solana and Ethereum keys from developers’ environments. The impostor crates, named faster_log and async_println, were published under the aliases rustguruman and dumbnbased, with May 25, 2025 as the upload date for faster_log version 1.7.8 and async_println version 1.0.1, copying the README, repository links, and naming conventions of the genuine fast_log package.

Socket’s Threat Research Team identified the two counterfeit packages and flagged faster_log as known malware after detecting typosquatting indicators and the exfiltration code; within hours Crates[.]io, in coordination with the Rust Security Response WG and the Rust Foundation, preserved the malicious files, removed the listings, locked the publisher accounts, and issued an official advisory.

The crates include a packer that scans source files for wallet-key patterns and exfiltrates them to a hardcoded C2 endpoint, and the operation accumulated 8,424 downloads before removal. According to Socket’s AI Scanner, the incident underscores rising supply-chain risks, prompting recommended actions such as removing the impostor packages, rotating secrets, and implementing secret-scanning and network-restriction measures.