`lwd-uri-util` was removed from crates.io for malicious code
Affects lwd-uri-utilSource GCVE Database
Rated High by Threat Radar's AI analysis
Data as of 11 Nov 2026, 10:33 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.iolwd-uri-utilpkg:cargo/lwd-uri-utilOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
The malicious crate has been removed from crates.io. Users should ensure they do not have dependencies on `lwd-uri-util` and audit their projects for any inclusion of this crate. Since the crate is no longer available, no further action is required from the vendor side.
Description
The `lwd-uri-util` crate on crates.io was found to contain malicious code that exfiltrated sensitive information such as SSH keys, AWS credentials, and other environment secrets during the build process of any crate that used it. The crate had eight versions published on 2026-11-09 and was removed approximately 12 hours later. There is no evidence that the crate was widely used or had dependencies on crates.io.