MalwarePublished 12 Nov 2026

basek (crates.io) · Malicious Code

Affects basekSource GCVE Database

Malicious package : remove basek and rotate any secrets on hosts that installed it.

Data as of 13 Nov 2026, 03:22 UTC

Classification

Malicious package

Published to crates.io · OSV MAL-2026-19200

What to do

Remove basek from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
crates.iobasek	Affected =0.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The basek 0.1.0 crate on crates.io is a malicious Rust library functioning as a Windows keylogger. It captures keystrokes including alphanumeric, function, and special keys, and exfiltrates the data to a Telegram Bot API endpoint and a secondary web server. The malware establishes persistence by copying itself to a local appdata directory, creating a Run registry key, spawning a watchdog process to ensure continuous operation, and deleting its original binary. It employs timing delays and randomized polling to evade sandbox and behavioral detection. Although described as an educational cybersecurity project, its obfuscation and persistence mechanisms indicate malicious intent.

Impact

The keylogger captures sensitive user input including keystrokes and username, which can lead to credential theft and unauthorized access. The exfiltration of data to attacker-controlled endpoints compromises user privacy and security. Persistence mechanisms ensure the malware remains active across system reboots, increasing the risk of prolonged data compromise. The evasion techniques reduce the likelihood of early detection by security tools.

Defensive guidance

The recommended mitigation is to avoid using or installing the basek 0.1.0 crate. Remove any instances of the malware by deleting the copied binary at %LOCALAPPDATA%\WindowsSystemUtility\WinSysUtils.exe, cleaning the Run registry key 'WinSysUtils', and terminating any watchdog processes spawned by the malware. Employ endpoint security solutions to detect and block similar malicious behaviors.

Summary

basek 0.1.0 is a Windows keylogger implemented as a Rust library. It exposes a get_data() function that polls Windows key states and batches captured keystrokes with the local username. The data is exfiltrated via POST requests to the Telegram Bot API using an XOR-obfuscated bot token and a hardcoded chat ID, as well as to a secondary URL. For persistence, the crate copies itself to %LOCALAPPDATA%\WindowsSystemUtility\WinSysUtils.exe, sets a Run registry key, spawns a watchdog process with a randomized filename to respawn the keylogger if terminated, and schedules self-deletion of the original binary. It uses a 30-second initial sleep and a 20-second warmup period with randomized polling jitter to evade detection. Despite claims of being an educational project, the presence of obfuscation, hardcoded attacker identifiers, persistence, and self-deletion features confirm its malicious nature.

References

crates.io/crates/basek/0.1.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Nov 2026, 03:22 UTC

Technical details

References

Community reviews