# MAL-2026-16164: Malicious code in logs_update (crates.io)


- **Type:** Malicious package
- **Package:** `logs-update` (crates.io)
- **Published:** 11 Sep 2026

## What is MAL-2026-16164?

MAL-2026-16164 is a malicious package in logs-update, published on 11 Sep 2026. 

### Official description

logs-update is a malicious crate published to crates.io on 2026-09-10 with zero downloads. It pretends to be a terminal progress-bar library, but renders nothing to a terminal. The whole crate steals files and sets up remote access.

The crate has no build script, so it does not run during `cargo build` of a dependent. It runs when someone runs its binary (for example after `cargo install logs-update`) or when a dependent calls its run() function.

When it runs, it does four things:

1. It POSTs a machine fingerprint (username, OS, and local IP) to https://rust-api-jet.vercel.app/api/validate/system-info.

2. It reads the project's .env and its trading-bot config files and POSTs them to https://rust-api-jet.vercel.app/api/validate/project-env.

3. It walks the filesystem and POSTs the contents of .env, .json, .txt, .doc, .docx, and .xlsx files to https://rust-api-jet.vercel.app/api/validate/files.

4. On Linux, it appends an attacker's SSH public key to ~/.ssh/authorized_keys, giving the attacker remote login as that user.

The crate targets crypto trading-bot developers: it hunts Polymarket order-book client configs, and those developers keep exchange API keys and wallet secrets in their .env files. Every version is malicious.

Attacker SSH public key appended to ~/.ssh/authorized_keys (comment yyy@gmail.com): ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDGheept5OU9//Jp0Zfq3F49s8sqkq7k6n4DA43N/DKgXz3qsQduaCHwdRmHKnx+y3SGaCGl3zlwYh5P+IO3TDfhnfPeEcIabTfHGSwJCzWF155gePLEHE1ClcZqDkMCKKJk9QumEj+5fM1LKWwx2OA+zhegm06pDpn7+6rJk6yOIXauHlnRrELlC6R/nxCAIPtA8988cbRMA6g2gqpWnbgN5NZgcT5+2RB8yZJ6uEk0IG/HrdbxYiOVMF+GTJjMmeiTMskstLlv1DHTT25BiTRA8N8l26bS5KLD7gS0dM+//G/DrcpQ89485gqOO8oZKJsagG78ez20CO6t+1A6vcBoEJljonP8S72g/cYPdB9SofHSCRPOImNXy/wwHMzOKeQrpAn2MbY3evUNPt4Tx/2eXpP1t+0P+3aLIO6MbDq7pHYAwHP54Tj5HFFbOLEcG3e5BmM4h5m5ZCa0+tsb6Jpkf7okFeEuY3NOcr1JdvmrKMPsLMsSZTb0QOJFmK4dA0S95PRtMPTut5zfKg6gznMhwl8pl8Vfdf0a62TTrmDGTvYPVUh+QtFupyjqHa3LU1s0V53btWzqtTxVSjYj2qxTfuZ1ZSOegDwQtxvMDxf5EJvt02mSZ8zRqxwVYtPn6dofrkE4Kl0eYL/4eYuO5bvZfOns/XYTC4bjt7V/j0SOQ== yyy@gmail.com

## What should I do about MAL-2026-16164?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-16164 is a malicious package: logs-update (crates.io). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-16164/ (Markdown: https://insights.sbomify.com/MAL-2026-16164/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-16164

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-16164/
Summaries are generated and may contain mistakes; the official description above is the record.