{"answers":{"affected":"1 open source package ship an affected version, including logs-update.","exploited":"There is no known exploitation of MAL-2026-16164 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-16164 is a malicious package in logs-update, published on 11 Sep 2026."},"fix_prompt":"MAL-2026-16164 is a malicious package: logs-update (crates.io). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-16164/ (Markdown: https://insights.sbomify.com/MAL-2026-16164/index.md)","id":"MAL-2026-16164","markdown":"https://insights.sbomify.com/MAL-2026-16164/index.md","name":"MAL-2026-16164","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"logs-update is a malicious crate published to crates.io on 2026-09-10 with zero downloads. It pretends to be a terminal progress-bar library, but renders nothing to a terminal. The whole crate steals files and sets up remote access.\n\nThe crate has no build script, so it does not run during `cargo build` of a dependent. It runs when someone runs its binary (for example after `cargo install logs-update`) or when a dependent calls its run() function.\n\nWhen it runs, it does four things:\n\n1. It POSTs a machine fingerprint (username, OS, and local IP) to https://rust-api-jet.vercel.app/api/validate/system-info.\n\n2. It reads the project's .env and its trading-bot config files and POSTs them to https://rust-api-jet.vercel.app/api/validate/project-env.\n\n3. It walks the filesystem and POSTs the contents of .env, .json, .txt, .doc, .docx, and .xlsx files to https://rust-api-jet.vercel.app/api/validate/files.\n\n4. On Linux, it appends an attacker's SSH public key to ~/.ssh/authorized_keys, giving the attacker remote login as that user.\n\nThe crate targets crypto trading-bot developers: it hunts Polymarket order-book client configs, and those developers keep exchange API keys and wallet secrets in their .env files. Every version is malicious.\n\nAttacker SSH public key appended to ~/.ssh/authorized_keys (comment yyy@gmail.com): ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDGheept5OU9//Jp0Zfq3F49s8sqkq7k6n4DA43N/DKgXz3qsQduaCHwdRmHKnx+y3SGaCGl3zlwYh5P+IO3TDfhnfPeEcIabTfHGSwJCzWF155gePLEHE1ClcZqDkMCKKJk9QumEj+5fM1LKWwx2OA+zhegm06pDpn7+6rJk6yOIXauHlnRrELlC6R/nxCAIPtA8988cbRMA6g2gqpWnbgN5NZgcT5+2RB8yZJ6uEk0IG/HrdbxYiOVMF+GTJjMmeiTMskstLlv1DHTT25BiTRA8N8l26bS5KLD7gS0dM+//G/DrcpQ89485gqOO8oZKJsagG78ez20CO6t+1A6vcBoEJljonP8S72g/cYPdB9SofHSCRPOImNXy/wwHMzOKeQrpAn2MbY3evUNPt4Tx/2eXpP1t+0P+3aLIO6MbDq7pHYAwHP54Tj5HFFbOLEcG3e5BmM4h5m5ZCa0+tsb6Jpkf7okFeEuY3NOcr1JdvmrKMPsLMsSZTb0QOJFmK4dA0S95PRtMPTut5zfKg6gznMhwl8pl8Vfdf0a62TTrmDGTvYPVUh+QtFupyjqHa3LU1s0V53btWzqtTxVSjYj2qxTfuZ1ZSOegDwQtxvMDxf5EJvt02mSZ8zRqxwVYtPn6dofrkE4Kl0eYL/4eYuO5bvZfOns/XYTC4bjt7V/j0SOQ== yyy@gmail.com","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in logs_update (crates.io)","id":"MAL-2026-16164","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"crates.io","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":[],"introduced":["0"],"last_affected":[],"package":"logs-update","purl":"pkg:cargo/logs-update","source":"MAL-2026-16164"}],"products":null,"published":"2026-09-11","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-16164/"}