Radar · Rust · Archive · Week 39 · Sep 22 – 28, 2025
Malicious Crates Faster_log and Async_println Removed
Breakingtooling
- What changed
- The crates.io registry removed the malicious crates
faster_logandasync_println. - Production impact
- Any build that depended on these crates will fail to resolve.
- Try it
cargo search faster_logto see that the crate is no longer available.- Source
- blog.rust-lang.org/2025/09/24/crates.io-malicious-crates-fasterlog-and-asyncprintln/
Understand it, then run it
On September 24, 2025 the crates.io registry removed two crates named faster_log and async_println. These crates were malicious: when a program that used them ran, they searched log files for private keys and sent any found data to an external server. If your project listed either of those crates in its Cargo.toml, the build will now fail because the registry no longer hosts them. You will need to replace the dependency with a safe alternative or remove it entirely.
Run it now
// This program demonstrates that the crates `faster_log` and `async_println` are no longer available
// on crates.io. Attempting to add them as dependencies will cause Cargo to fail during resolution.
// Since they are not part of the standard library, we simply print a message.
fn main() {
println!("If you try to depend on `faster_log` or `async_println`, Cargo will now error out.");
}
What it printed when we ran it on Rust 1.98.1 (edition 2024)
If you try to depend on `faster_log` or `async_println`, Cargo will now error out.
Run sends this program (for Solidity, the contract and its tests) to our own sandbox, where it is compiled and run once, with no network, and what it printed or the test report comes back here. Nothing is kept. Runs are counted per visitor for the day so everyone gets a turn; the details are on the legal page.
Written by gpt-oss-20b from the linked source · claims checked against the sources · archive, not individually reviewed