Summary
On December 2nd, the crates.io team was notified by Olivia Brown from the Socket Threat Research Team of two malicious crates which were downloading a payload that was likely attempting to steal cryptocurrency.
These crates were:
evm-units - 13 versions published in April 2025, downloaded 7257 timesuniswap-utils - 14 versions published in April 2025, downloaded 7441 times, used evm-units as a dependency
Actions taken
The user in question, ablerust, was immediately disabled, and the crates in question were deleted from crates.io shortly after. We have retained the malicious crate files for further analysis.
The deletions were performed at 22:01 UTC on December 2nd.
Analysis
Socket has published their analysis in a blog post.
These crates had no dependent downstream crates on crates.io.
Thanks
Our thanks to Olivia Brown from the Socket Threat Research Team for reporting the crates. We also want to thank Carol Nichols from the crates.io team and Walter Pearce and Adam Harvey from the Rust Foundation for aiding in the response.
Instagram Engineering
Shopify Engineering