Supply chain · rust · High

Malicious Rust Package 'replit_ruspty' Identified in crates.io

Threat Engine Auto-Feed · data current as of 2026-07-18

A malicious version of the 'replit_ruspty' package (1.0.0) has been identified in the Rust ecosystem's crates.io registry. This package communicates with malicious domains and executes malicious commands, posing a critical supply-chain risk to projects that incorporated it.

  • Package: rust / replit_ruspty
  • Affected versions: = 1.0.0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Malicious package

The OpenSSF Package Analysis project identified 'replit_ruspty' version 1.0.0 on crates.io as malicious. The package was flagged due to its communication with domains linked to malicious activity and its execution of commands associated with malicious behavior.

How the attack works

This type of attack involves an adversary publishing a seemingly legitimate software package that secretly includes malicious code. When developers integrate this package into their projects, the malicious code can execute during build processes or runtime, potentially compromising the development environment or deployed applications. The package's malicious actions, such as network communication to suspicious domains or command execution, occur without explicit user consent, enabling unauthorized activities.

Who's exposed

Profiles most at risk

  • Development teams using the Rust ecosystem
  • Organizations whose CI/CD pipelines pull dependencies directly from crates.io
  • Projects that have 'replit_ruspty' version 1.0.0 as a direct or transitive dependency

Conditions that increase exposure

  • Unpinned dependencies that automatically update to the malicious version
  • Lack of dependency lockfiles (e.g., Cargo.lock) or not committing them to version control
  • Using internal package mirrors that have not been updated to exclude the malicious version
  • Build environments with broad network access that allow outbound connections to arbitrary domains

Blast-radius scenarios

  • If installed, the package could establish unauthorized network connections to attacker-controlled infrastructure, potentially exfiltrating data or receiving further instructions.
  • The execution of malicious commands could lead to system compromise, data manipulation, or the deployment of additional malware within the build environment or target system.
  • Compromised build environments could inject malicious code into downstream artifacts, affecting all users of the compromised software.

What to do (defensive)

Detect

  • Review Cargo.toml and Cargo.lock files for 'replit_ruspty' version 1.0.0.
  • Scan dependency trees for 'replit_ruspty' version 1.0.0 using software composition analysis (SCA) tools.
  • Monitor network traffic from build systems and applications for connections to suspicious or unknown domains.
  • Analyze system logs for unexpected command executions originating from Rust build processes or applications.

Contain

  • Immediately quarantine any systems or build environments found to have installed 'replit_ruspty' version 1.0.0.
  • Block network access from affected systems to known malicious domains.
  • Isolate development and build environments from production networks.
  • Temporarily disable builds that rely on the affected package until remediation is complete.

Remediate

  • Remove 'replit_ruspty' version 1.0.0 from all project dependencies.
  • Update Cargo.lock files to explicitly exclude the malicious version and pin to known-good versions of all dependencies.
  • Rebuild all affected projects from a clean state, ensuring no malicious dependencies are present.
  • Rotate credentials for any systems or services that may have been exposed during the period of compromise.
  • Conduct a thorough security audit of affected systems and codebases to identify any lingering compromise or backdoors.

Frontier verdict — High

This is a critical supply-chain alert requiring immediate action to identify and remove the malicious 'replit_ruspty' package from all Rust projects.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.