Stealth Supply Chain Attack: Malicious Rust Crate Used Unpinned Dependency for Silent Payload Upgrades

A stealth supply chain attack targeted Rust developers with a malicious package disguised as a legitimate library, finch-rust, which mimicked the finch genomics tool. The loader declared a dependency on another malicious package, sha-rust, using an unpinned version specification (0.1) that let threat actors silently upgrade the payload without changing the loader.

The payload, sha-rust, evolved through eight iterations over two weeks, beginning by scanning the victim’s home directory and later concentrating on the current directory to avoid detection. The malware sought credentials in Environment Files such as .env, production[.]env and staging[.]env, as well as Config Files like config[.]toml and identity tokens in id.json, exfiltrating data via HTTPS POST to rust-docs-build.vercel[.]app/api/v1 with 100 ms delays to evade detection.

The threat actor, operating under the alias “faceless,” employed typosquatting to impersonate the real finch library, and engaged in identity theft by forging a credible GitHub persona; the incident was reported to the Rust Security team and removed almost immediately, highlighting ongoing risks in open-source ecosystems. according to Socket Threat Research Team.