The `lwd-uri-util` crate on crates.io was found to contain malicious code that exfiltrated sensitive information such as SSH keys, AWS credentials, and other environment secrets during the build process of any crate that used it. The crate had eight versions published on 2026-11-09 and was removed approximately 12 hours later. There is no evidence that the crate was widely used or had dependencies on crates.io.