Threats affecting pkg:cargo/lwd-uri-util

The `lwd-uri-util` crate on crates.io was found to contain malicious code that exfiltrated sensitive information such as SSH keys, AWS credentials, and other environment secrets during the build process of any crate that used it. The crate had eight versions published on 2026-11-09 and was removed approximately 12 hours later. There is no evidence that the crate was widely used or had dependencies on crates.io.

The lwd_uri_util crate on crates.io contains malicious code in its build.rs script that executes during cargo build or check. This script collects environment variables, hostname, and username, then sends this data to attacker-controlled URLs. It targets specific environment variables related to credentials and signing keys, enabling potential compromise of code-signing and package publishing processes.