Supply chain · rust · High

Malicious Rust Package 'proton-pfff' Identified in crates.io

Threat Engine Auto-Feed · data current as of 2026-07-18

A malicious version of the 'proton-pfff' package (99.99.5) has been identified in the Rust ecosystem's crates.io registry. This package communicates with a known malicious domain and executes commands associated with malicious behavior, posing a critical supply chain risk to projects that have integrated it.

  • Package: rust / proton-pfff
  • Affected versions: = 99.99.5
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Malicious package

The OpenSSF Package Analysis project identified version 99.99.5 of the 'proton-pfff' package on crates.io as malicious. This specific version was found to communicate with a domain associated with malicious activity and execute commands indicative of malicious behavior.

How the attack works

This is a malicious package attack where a seemingly legitimate software component is compromised or created with malicious intent. When integrated into a project, the malicious code within the package can execute unauthorized actions, such as establishing communication with attacker-controlled infrastructure or running arbitrary commands on the host system, potentially leading to data exfiltration or further system compromise.

Who's exposed

Profiles most at risk

  • Development teams using the Rust ecosystem (crates.io)
  • Organizations whose CI/CD pipelines pull dependencies from crates.io
  • Projects that directly or transitively depend on 'proton-pfff' version 99.99.5

Conditions that increase exposure

  • Unpinned dependencies that allow automatic updates to the malicious version
  • Lack of dependency lockfiles or infrequent lockfile updates
  • Use of internal mirrors that have synchronized the malicious package version
  • Build environments with broad network access that permit outbound connections to arbitrary domains

Blast-radius scenarios

  • An attacker could establish C2 communication from compromised build environments or deployed applications.
  • An attacker could execute arbitrary commands on systems where the malicious package is installed and run, potentially leading to system compromise or data breach.
  • The blast radius includes any system that builds or runs software incorporating the malicious 'proton-pfff' version 99.99.5.

What to do (defensive)

Detect

  • Scan dependency trees for 'proton-pfff' version 99.99.5.
  • Monitor network traffic from build systems and applications for outbound connections to suspicious or unknown domains.
  • Review system logs for unusual command execution originating from Rust applications or build processes.

Contain

  • Immediately isolate any systems identified as having installed or run 'proton-pfff' version 99.99.5.
  • Block network communication to known malicious domains from all development and production environments.
  • Prevent further downloads or use of 'proton-pfff' version 99.99.5 from package registries and internal mirrors.

Remediate

  • Remove 'proton-pfff' version 99.99.5 from all projects and replace with a known safe version or alternative, if available.
  • Force dependency resolution to use only trusted, pinned versions of all packages.
  • Perform a thorough security audit of any system that has processed or executed the malicious package to identify and remove any persistent compromise.
  • Rotate credentials that may have been exposed on compromised systems.

Frontier verdict — High

Prioritize immediate action to identify and remove 'proton-pfff' version 99.99.5 due to its critical severity and direct malicious behavior.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.