{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-OSM-2026-14782","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-11-10T05:53:25Z","dateUpdated":"2026-11-10T09:16:16Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"This package is a malicious credential and environment stealer.  This looks like a supply-chain loader targeting Rust package consumers: the build script `build.rs` executes commands and contains decoded base64 content with a real webhook URL, which is consistent with compiling-time exfiltration or staged payload delivery. The recovered IOC `https://webhook.site/14b3cc9b-3275-4b63-8b93-f4d2669fbdc1` plus the `webhook.site` domain is a classic attacker-controlled sink, not a legitimate library endpoint. The package is brand-new and published in a rapid version burst, which fits a throwaway malicious package rather than a normal crate. The attacker model here is a developer or typosquat-style publisher using the Rust build pipeline to hide network activity during dependency installation/compilation.\n\nThe payload is the build script build.rs.\n\nIt steals repository-local files, searched from the crate directory through two parent levels:\n      • .env, .env.local, .env.production\n      • secrets.json, config.toml\n      • Fastlane configuration\n      • Android keystore properties and local.properties\n\nIt also exfiltrates user-level credentials and configuration:\n      • .git-credentials, .netrc\n      • AWS credentials\n      • SSH configuration\n      • GitHub CLI hosts/configuration\n      • Cargo, npm, and PyPI credentials\n      • Keplr MCP configuration, vault metadata, and up to eight encrypted vault files\n\nOBFUSCATION\n  - Decoded Base64 Content in build.rs (x2)\n  - recovered 1 urls, 1 domains from decoded/deobfuscated content\n\nADDITIONAL FINDINGS\n  - Rust Build Script Command Execution in build.rs: \"std::process::Command\"\n  - Brand New Package\n  - Rapid Version Publishing\n\nPAYLOAD FILES\n  build.rs","supportingMedia":null}],"references":[{"url":"https://opensourcemalware.com/threats/7bff661e-aaed-48e8-97c6-8e1ef6fc2de6","name":"Malicious crates package: lwd-uri-util","tags":["advisory"]},{"url":"https://crates.io/lwd-uri-util","name":"","tags":["vendor"]}],"metrics":[{"format":"CVSS_V3","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Embedded Malicious Code","cweId":"CWE-506","type":"CWE"}]}],"affected":[{"vendor":"unknown","product":"lwd-uri-util","collectionURL":"https://crates.io","packageName":"lwd-uri-util","repo":"","defaultStatus":"affected","versions":[{"version":"all","status":"affected","versionType":"","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}