Malicious Rust Crate Delivers OS-Specific Malware to Web3 Developer Systems

Cybersecurity researchers discovered a malicious Rust package named 'evm-units' uploaded to crates.io that targets Windows, macOS, and Linux systems. The malware disguises itself as an Ethereum Virtual Machine (EVM) unit helper tool to target Web3 developers. The package was uploaded by a user named 'ablerust' in mid-April 2025 and contains OS-specific malware designed to execute stealthily on developer machines. This represents a supply chain attack targeting the Rust ecosystem and Web3 development community.