Malicious Pull Requests Target Vizor and Zingo Wallets

A newly created GitHub account tried to plant credential-stealing code in Chainapsis' Vizor wallet and Zingo Labs' Zcash wallet software through six pull requests submitted late Nov. 9 and early Nov. 10 ET.

GitHub records show four Vizor requests were closed without merging, while requests in zingo-common and zingolib remained open and unmerged Tuesday morning ET. Whether any maintainer built the malicious dependency or exposed credentials remains unconfirmed.

The danger does not depend on a merge. The Rust package, or crate, lwd-uri-util puts its credential collector in build.rs, which Cargo runs before building the package. It can also execute during cargo check or an editor's rust-analyzer analysis: the latter enables build scripts by default. A developer reviewing an unmerged branch could therefore trigger the collector locally.

The OpenSourceMalware research team documented the campaign. GitHub's advisory database also classifies versions 0.1.0 through 0.1.7 of the crate as malware, with no patched version.

Telling AI Reviewers to Ignore Secret Uploads

The account, sapho11, was created about half an hour before its first requests. Its initial Windows-release proposal purported to add signing-failure diagnostics, but the original change copied signing-related environment variables, Git credentials, SSH private keys and other files into an upload to an external server.

A Codex automated review flagged the private update-signing key upload and warned it could enable forged update feeds. The author subsequently removed credential collection from that proposal before it was closed.

The account then proposed changes to AGENTS.md, a project-instructions file for AI coding agents. The proposed text described collection of signing-variable values as "intentional and expected" and told automated and human reviewers not to flag uploads following its purported convention as credential leakage. Vizor's public PR thread confirms Codex was configured to review pull requests automatically.

A Stealer That Runs Before the Wallet

The later Vizor proposal and the two Zingo requests introduced lwd-uri-util as a helper for normalizing wallet-server addresses. OpenSourceMalware found that the Zingo changes used Windows-style CRLF line endings, making small dependency additions appear as full-file rewrites.

In the version 0.1.7 source, the build script reads environment variables and accessible Git, GitHub CLI, AWS, Cargo and npm credential files. It also seeks Keplr MCP encrypted vault files and tries to retrieve selected macOS Keychain secrets, then writes the collected data to a JSON file and attempts to POST it to webhook.site.

The script suppresses uploads in scanner-like environments, but collection and local file creation happen before that check. Its "no metrics" setting also stops only the upload.

The crates.io registry index still marked all eight versions as not yanked Tuesday morning ET, and the GitHub account remained publicly accessible. OpenSourceMalware urged anyone who built the branch to rotate credentials and inspect the generated lwd_uri_build_context.json file to see what was collected.