From 29ac187a34714fea6657afe88e4900a4d3f1ad9c Mon Sep 17 00:00:00 2001 From: GrassedgeT Date: Mon, 13 Apr 2026 20:36:51 +0800 Subject: [PATCH] Add advisory for malicious crate `microsoftsystem64` --- crates/microsoftsystem64/RUSTSEC-0000-0000.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 crates/microsoftsystem64/RUSTSEC-0000-0000.md diff --git a/crates/microsoftsystem64/RUSTSEC-0000-0000.md b/crates/microsoftsystem64/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..8abbb8975 --- /dev/null +++ b/crates/microsoftsystem64/RUSTSEC-0000-0000.md @@ -0,0 +1,19 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "microsoftsystem64" +date = "2026-04-13" +expect-deleted = true +categories = ["malicious"] + +[versions] +patched = [] +``` + +# `microsoftsystem64` was removed from crates.io for malicious code + +`microsoftsystem64` installs a hardcoded SSH authorized_keys entry (persistence/backdoor) and scans for sensitive files (.env, credential-like JSON names, keyword-matching docs), reads their contents, base64-encodes where needed, and exfiltrates everything to a remote server via HTTP. It also packages and uploads Telegram Desktop tdata, indicating targeted credential/session/data harvesting. + +The malicious crate had 9 versions published on 2026-04-09 that had a total of 6404 downloads. There were no crates depending on this crate on crates.io. + +Thanks to [Socket.dev](https://socket.dev/) for detecting and reporting this to the crates.io team!