Supply chain · rust · High

Malicious Rust Package 'supertag' (v99.1.1) Identified

Threat Engine Auto-Feed · data current as of 2026-07-19

A malicious version of the 'supertag' package (v99.1.1) has been identified in the Rust ecosystem. This package communicates with malicious domains and executes commands, posing a critical supply-chain risk to any project that integrated it.

  • Package: rust / supertag
  • Affected versions: = 99.1.1
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Malicious package

The OpenSSF Package Analysis project identified 'supertag' version 99.1.1 on crates.io as malicious. The package was flagged due to its communication with a domain associated with malicious activity and the execution of commands indicative of malicious behavior.

How the attack works

This is a malicious package attack, where a seemingly legitimate software component is compromised to include harmful code. When integrated into a project, the malicious code executes during build or runtime, potentially establishing external communication channels or executing arbitrary commands on the host system.

Who's exposed

Profiles most at risk

  • Development teams using the Rust ecosystem
  • Organizations with CI/CD pipelines that automatically pull the latest versions of dependencies
  • Any project or application that directly or indirectly depends on 'supertag' version 99.1.1

Conditions that increase exposure

  • Unpinned dependencies in project manifests (e.g., Cargo.toml)
  • Lack of dependency lockfiles or infrequent updates to them
  • Use of internal package mirrors that do not vet incoming packages
  • Automated build systems that do not scan new dependencies for known threats

Blast-radius scenarios

  • If installed, the package could establish outbound connections to attacker-controlled infrastructure, potentially exfiltrating data or receiving further instructions.
  • Execution of malicious commands could lead to system compromise, data manipulation, or further lateral movement within the compromised environment.
  • The blast radius scales with the adoption of 'supertag' v99.1.1 across an organization's projects and the privileges under which those projects are built or run.

What to do (defensive)

Detect

  • Scan Rust projects for 'supertag' version 99.1.1 in Cargo.lock files or dependency trees.
  • Monitor network traffic for suspicious outbound connections from build environments or applications using Rust dependencies.
  • Implement package analysis tools in CI/CD pipelines to detect known malicious packages and anomalous behavior.

Contain

  • Immediately quarantine or remove any systems, build agents, or development environments found to have installed 'supertag' version 99.1.1.
  • Block network communication to known malicious domains identified by package analysis or threat intelligence.
  • Revoke credentials that may have been exposed on compromised build systems or development machines.

Remediate

  • Remove 'supertag' version 99.1.1 from all project dependencies; replace with a known good version if available and verified, or an alternative package.
  • Perform a thorough audit of affected systems for signs of compromise, including unauthorized file changes, new user accounts, or persistent malicious processes.
  • Update dependency management practices to pin versions and utilize lockfiles, along with regular security reviews of third-party packages.

Frontier verdict — High

This critical severity malicious Rust package requires immediate attention for detection and removal to prevent potential system compromise and data exfiltration.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.