shinchina-test 0.1.0

On March 3, 2025, the crates.io account hackersthan published shinchina-test 0.1.0, the crate's only version. Its description is "test", and its program only prints "Hello, world!". The crate also has a Cargo build script, build.rs. Whenever Cargo compiles the crate, that script sends the package name and version, the HOME directory, the hostname and the username to https://ztuqmrrhdaulxnqlxkstvsdvxronk5pzp.oast.fun/. oast.fun is a public interactsh out-of-band interaction server, used to collect callbacks. The script downloads nothing and runs nothing it receives, so this is a host-identifying probe of the kind used in dependency-confusion testing. It is not a backdoor. Twenty-seven minutes after this crate, the same account published build_dep 0.1.1, whose build script contacts the same callback host. crates.io has since removed shinchina-test, after about 20 months online, from March 3, 2025.

What the package does

Compiling shinchina-test 0.1.0 (crate sha256 471bc030bd165bf0f5b81b72b0337586500caeb8c9c34c951a1167b34e441d26) does this:

• Before the crate itself is compiled, Cargo compiles and runs its build script. That happens on cargo install shinchina-test, and whenever Cargo compiles or checks a project that depends on it, including the checks an editor's Rust language server runs in the background.
• The build script looks up the current user and hostname and reads the HOME environment variable.
• It resolves ztuqmrrhdaulxnqlxkstvsdvxronk5pzp.oast.fun and sends one HTTPS POST to https://ztuqmrrhdaulxnqlxkstvsdvxronk5pzp.oast.fun/. The body is a JSON object with five keys: p (the package name, shinchina-test), v (the version, 0.1.0), hd (the value of HOME), hn (the hostname) and un (the username).
• It ignores the response and any error, so compilation goes on normally whether the request succeeds or not. Nothing visible marks that the request was sent.
• The installed program, shinchina-test, prints "Hello, world!" and does nothing else. It makes no network connection.

What the code does

The .crate archive (sha256 471bc030bd165bf0f5b81b72b0337586500caeb8c9c34c951a1167b34e441d26, the cksum the crates.io index lists for 0.1.0) holds five files: Cargo.toml, Cargo.toml.orig, Cargo.lock, build.rs (sha256 d5d79ae057125df63494b5cbd537630ceafce00c52879687ebcdfdba179415c6, 28 lines) and src/main.rs.

• Cargo.toml.orig:7 names build.rs as the crate's build script, with the comment # Use build.rs as the build script. Cargo.toml.orig:17–21 gives the script its own dependencies: reqwest 0.11 with its blocking client, serde_json, whoami and sys-info. Cargo.toml.orig:10–15 repeats them as ordinary dependencies, but src/main.rs uses none of them. The manifest names its author with a misspelled key, auther = "sachin" (Cargo.toml.orig:3), so Cargo ignores it.
• build.rs:7–8 takes the package name and version from Cargo's CARGO_PKG_NAME and CARGO_PKG_VERSION.
• build.rs:10–16 assembles the JSON object under the variable name tracking_data: "p", the package name; "hd", env::var("HOME"); "hn", whoami::fallible::hostname(); "un", whoami::username(); and "v", the version.
• build.rs:18–22 POSTs that object as Content-Type: application/json to https://ztuqmrrhdaulxnqlxkstvsdvxronk5pzp.oast.fun/. Line 19 still carries the template comment // Change to your server URL.
• build.rs:24–27 throws away the result: Ok(_) => {} // Ignore response and Err(_) => {} // Ignore errors to prevent installation failures.
• src/main.rs:1–3 is println!("Hello, world!");.
• Nothing in the crate reads files, other environment variables or credentials. It does not use the response, start other programs or write anything outside Cargo's own output directory. sys-info is declared but never called.

The crate has no function of its own beyond the request. It has no documentation or repository, and its description is "test". What it sends is enough to tell the publisher which user on which machine compiled it, and the HOME path usually repeats the username. It sends no secrets or file contents. The callback host and the account that published both crates are the only links between shinchina-test and build_dep.

Timeline (UTC)

If you installed it

The crate takes nothing beyond the identity of the machine and user, but the publisher now knows that this host compiled it.

1. Remove the crate: cargo uninstall shinchina-test if it was installed as a program, or drop it from Cargo.toml and run cargo update if a project depends on it. Delete its compiled output under target/ (cargo clean).
2. Search firewall, proxy and DNS logs for ztuqmrrhdaulxnqlxkstvsdvxronk5pzp.oast.fun and other oast.fun names, and block oast.fun if your network has no use for it.
3. Check how the crate got into the dependency tree. If it arrived through a typo, a confusable name or a misconfigured registry, fix that source, since the next crate it brings in may do more than report the host.
4. No credentials are read or sent, so this crate gives no reason to rotate keys.