Malicious Rust Package ‘evm-units’ Exposes Crypto Developers to Stealth Attacks

Malicious Rust Package evm-units, discovered by The Socket Threat Research Team, masqueraded as a tool for handling Ethereum Virtual Machine units but carried a stealth loader that could silently compromise victim machines. The package, authored by ablerust, had more than 7,000 all-time downloads and remained live on Crates[.]io for eight months before removal.

It hides in plain sight by returning an Ethereum version number, while a hidden get_evm_version() function triggers a sequence that downloads a OS-specific payload and executes with stealth, using nohup on Linux/macOS or a VBScript wrapper to run a hidden PowerShell window on Windows.

The researchers note a particular interest in victims within Asian markets, aided by checks for qihoo.exe associated with Qihoo360, a Chinese antivirus provider; if detected, the malware switches to a direct PowerShell command to bypass the VBScript wrapper. A supply-chain attack was also implied through a second package, uniswap-utils, which depended on evm-units and deployed code at initialization via the #[ctor::ctor] annotation, weaponising Rust’s testing feature.