The lwd_uri_util crate on crates.io contains malicious code in its build.rs script that executes during cargo build or check. This script collects environment variables, hostname, and username, then sends this data to attacker-controlled URLs. It targets specific environment variables related to credentials and signing keys, enabling potential compromise of code-signing and package publishing processes.