Poisoned Pipeline / Incidents / AS164

AS164 · 2026-03

Five Rust crates as time utilities steal .env

crates.io

Socket: five malicious Rust crates posed as time utilities to exfiltrate .env files.

Mapped techniques

• T0109 Publish malicious artifact
• T0184 Harvesting sensitive information from files

supply-chain campaign

Sources

• https://socket.dev/blog/5-malicious-rust-crates-posed-as-time-utilities-to-exfiltrate-env-files