log-upgrades 0.1.2

log-upgrades is malicious: a supply-chain attack — installing or importing it compromises the machine. It is marketed as a Rust library that logs by overwriting terminal output, a description copied verbatim from the npm package log-update, but its documented startup call run() collects and uploads the machine's identity, the project's .env file and Polymarket SDK config files, and a filesystem-wide sweep of env/json/text/office files to a hard-coded endpoint on a free hosting domain, and then appends the author's SSH public key to ~/.ssh/authorized_keys, giving the author SSH access to the machine. It is published to crates.io as version 0.1.2, its only release, by the account ghost_435604, first published July 22, 2026; the manifest names https://github.com/jextradeslab as repository, which does not resolve.

What log-upgrades does

• Presents itself as a terminal-log utility ("Log by overwriting the previous output in the terminal"), with a README that tells users to call run() from application startup, and a log-upgrades CLI that calls the same run() (src/main.rs:12-13).
• run() (src/lib.rs:56-95) performs four steps in order; a network failure in any of the first three only prints a warning and the sequence continues, so nothing user-visible stops it.

What the code does

• src/lib.rs:18-21, src/system_info.rs:21-49 — collects the OS, the first non-internal IPv4 address and the username, and POSTs them as JSON to https://rust-api-jet.vercel.app/api/validate/system-info.
• src/lib.rs:62-74, src/project_env.rs:46-90 — reads the current directory's .env and POSTs its full contents, with the project path, OS, IP and username, to https://rust-api-jet.vercel.app/api/validate/project-env.
• src/project_env.rs:27, 51-153 — walks the project tree for Polymarket SDK config files (env.ts, config.ts, createClobClient.ts, clob.ts) and uploads their contents in the same POST.
• src/filesystem_sweep.rs:192-236, 261-330 — scans $HOME, every directory under /home and /root on Linux, drives C: through J: on Windows and /Users on macOS, ten levels deep, collecting .env, .json, .txt, .doc, .docx and .xlsx files while skipping only blocklisted directory names (node_modules, target, ssh, and similar).
• src/filesystem_sweep.rs:345-450 — POSTs the collected file contents in 256 KiB batches (each item capped at 128 KiB) to https://rust-api-jet.vercel.app/api/validate/files, with the OS, IP and username; .doc, .docx and .xlsx contents are base64-encoded.
• src/lib.rs:24-25, 90-92, 103-127 — on Linux, appends the built-in SSH public key (an ssh-ed25519 key commented dev-key) to ~/.ssh/authorized_keys, creating ~/.ssh if needed and setting modes 700/600. Whoever holds the matching private key gains SSH access to the machine.

Timeline (UTC)

If you installed it

• Remove the ssh-ed25519 line ending in dev-key from ~/.ssh/authorized_keys (the exact line is built into the package, src/lib.rs:24-25), and review SSH authentication logs for use of that key.
• Treat every secret in .env files under your home directory (and on Windows the C: through J: drives), in .json, .txt, .doc, .docx and .xlsx files up to 128 KiB, and in Polymarket SDK config files, as leaked to the author's host: rotate the keys and tokens in them.
• Remove the dependency (cargo remove log-upgrades, cargo uninstall log-upgrades). No setting disables the sequence: every default endpoint points at the author's host, and run_with_config only substitutes endpoints of the same shape.