Lwd uri util: Malicious code
Affects lwd-uri-utilSource GCVE Database
Malicious package : remove lwd-uri-util and rotate any secrets on hosts that installed it.
Data as of 10 Nov 2026, 06:18 UTC
Malicious package
Published to crates.io · OSV MAL-2026-19058
What to do
Remove lwd-uri-util from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| crates.iolwd-uri-util | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The lwd_uri_util crate on crates.io contains malicious code in its build.rs script that executes during cargo build or check. This script collects environment variables, hostname, and username, then sends this data to attacker-controlled URLs. It targets specific environment variables related to credentials and signing keys, enabling potential compromise of code-signing and package publishing processes.