1 line
3.1 KiB
JSON
1 line
3.1 KiB
JSON
{"schema_version":"1.9.2","id":"MAL-2026-19201","published":"2026-11-12T21:47:28Z","modified":"2026-11-12T22:15:03.375909617Z","summary":"Malicious code in hesk (crates.io)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (83716a1c499cecbd64fe45f5ff56ab70ea6d1543e922c55e0514f2e2a69fe391)\nThe crate ships two reachable async payloads — `pub async fn dat` in src/test.rs and `pub async fn bs` in src/parse.rs, both imported from src/lib.rs — that walk the user's home directory with walkdir, build a zip archive via zip::ZipWriter including wallet artefacts (e.g. `exodus.wallet`), and upload the archive via reqwest multipart to a hardcoded Telegram Bot API endpoint using embedded `API_` token and `chat_id` constants. Both payload files (parse.rs ~40KB, test.rs ~60KB) are padded with roughly a hundred nonsense filler functions with invented identifiers (Modemir65, mix_wisp_30, Flagzelk147, shuffle_zelkvak_73, etc.) surrounding the exfiltration functions at the end of each file, consistent with deliberate camouflage. The dependency set — evdev and rdev (keyboard capture), winreg plus winapi winuser/processthreadsapi/memoryapi (Windows registry and process/memory primitives), walkdir, zip, and reqwest with the multipart feature — extends the capability surface to cross-platform keylogging and Windows persistence. The crate description `Это учебный проект для тестирования кибербезопасности` (\"educational project for cybersecurity testing\") does not match the shipped behavior.\n","affected":[{"package":{"name":"hesk","ecosystem":"crates.io","purl":"pkg:cargo/hesk"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/test.rs","sha256":"88d81962e8d5d31e64a152a3d0119e3e9522d00003d54f7be3a033cf5f3ef697","tlsh":"3243434b49f30969b023f8bd575fb9023134895f490dde957e7c6320af0a0a956f2af8"},{"path":"src/parse.rs","sha256":"6bf6443ffb37ce3a2501ff9ae7310d94a83387e7c61915b7f465dbb5a44949c0","tlsh":"7103534558f60875a057f8ad1b4eb813762849af1a0dfe147ebc23309f4b0695af1fd8"},{"path":"Cargo.toml","sha256":"933a826e1909f631bece7ab65e900392c8984040defd04fb01cbc517d7d6ac86","tlsh":"4331333e620afb362d5732e0889d65e60fe33109255daa6496dbc05c3e4c6cec2fc835"}],"package_integrity":[{"filename":"hesk-0.1.0.crate","hashes":{"sha256":"09bc0f16645e5dcc64f9a73d93e032bf4d347192ed541b9aeddfba7c87e68419"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/crates.io/hesk/MAL-2026-19201.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hesk/0.1.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022651","import_time":"2026-11-12T22:10:48.400085278Z","modified_time":"2026-11-12T21:47:28Z","sha256":"83716a1c499cecbd64fe45f5ff56ab70ea6d1543e922c55e0514f2e2a69fe391","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]} |