# lwd-uri-util malicious code in Rust crate

Source: https://junglewise.ai/threats/rustsec-2026-0483-lwd-uri-util-was-removed-from-crates-io-for-malicious-7e009ea3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-13  
License: CC BY 4.0 with a link back

Severity: info · Published 2026-11-10

The lwd-uri-util Rust library was published to the public package repository with malicious code designed to steal SSH keys, AWS credentials, and other sensitive environment variables during software builds. Any developer or organization who used this library would have had their secrets exfiltrated to an attacker-controlled location. The malicious package was available for approximately 12 hours before removal.

Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** lwd-uri-util (crates.io) 0.0.0-0 and higher; 8 versions published 2026-11-09, SEMVER:introduced=0.0.0-0.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run lwd-uri-util (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A malicious Rust crate was published to crates.io with functionality to exfiltrate SSH keys, AWS credentials, and other environmental metadata and secrets at build time. The attack requires a developer to include the compromised crate as a dependency in their project build. Eight versions of the crate were published on 2026-11-09 before being removed from the package registry; no evidence of actual exploitation in the wild was identified.

## Affected products

- crates.io lwd-uri-util 0.0.0-0 and higher; 8 versions published 2026-11-09

## Timeline

- 2026-11-10: disclosed: Vulnerability reported to RustSec
- 2026-11-09: other: 8 malicious versions published to crates.io
- 2026-11-09: other: Malicious crate removed from crates.io approximately 12 hours after publication

## References

- [https://crates.io/crates/lwd-uri-util](https://crates.io/crates/lwd-uri-util)
- [https://rustsec.org/advisories/RUSTSEC-2026-0483.html](https://rustsec.org/advisories/RUSTSEC-2026-0483.html)