Malicious Pull Requests Target Vizor and Zingo Wallets

By Nathan Brooks

GitHub’s advisory database classifies all eight published versions of the lwd-uri-util crate, from 0.1.0 through 0.1.7, as malware and identifies no patched version, according to the OpenSourceMalware research team.

The team documented malicious pull requests aimed at the Vizor and Zingo wallet projects. The requests sought to introduce lwd-uri-util as a helper for normalizing wallet-server addresses, but version 0.1.7 contained a build script that collected credentials.

The account behind the requests, sapho11, was created about 30 minutes before its first requests. Its initial proposal for a Windows release purported to add diagnostics for signing failures. The original change, however, copied signing-related environment variables, Git credentials, SSH private keys and other files to an external server.

An automated Codex review flagged the upload of the private update-signing key and warned that it could enable forged update feeds. The author subsequently removed the credential collection from that proposal before the pull request closed.

What did the pull requests attempt to collect?

The account next proposed changes to AGENTS.md, the project-instructions file for AI coding agents. The proposed text described the collection of signing-variable values as "intentional and expected" and instructed automated and human reviewers not to flag uploads following the purported convention as credential leakage.

That proposal sought to influence review behavior. Vizor’s public pull-request thread confirms that Codex was configured to review pull requests automatically, documenting an active automated-review configuration alongside the malicious requests.

OpenSourceMalware found that the later Vizor proposal and the two Zingo requests used Windows-style CRLF line endings. The formatting made small dependency additions appear as full-file rewrites, obscuring the scale of the proposed changes.

How did the script gather credentials?

In version 0.1.7, the build script reads environment variables and accessible credential files for Git, GitHub CLI, AWS, Cargo and npm. It also looks for Keplr MCP encrypted vault files and attempts to retrieve selected macOS Keychain secrets.

The script writes the collected data to a JSON file and attempts to POST it to webhook.site. Its scanner-detection logic can suppress uploads in scanner-like environments, but collection and local file creation occur before that check. A setting labeled "no metrics" stops only the upload, not the collection process.

That ordering matters for developers who ran the code. A blocked outbound transfer can leave a local record of accessed credentials, so suppressing exfiltration does not remove the need to inspect the build environment.

What does this change for developers?

The documented requests concern malicious code in proposed development changes. They do not establish that Vizor or Zingo shipped lwd-uri-util, and the research does not report a theft from wallet users. The risk centers on developers and build environments that ran the proposed dependency, not a confirmed compromise of wallet funds.

On Tuesday morning in US Eastern Time, the crates.io registry index still marked all eight versions as not yanked, and the sapho11 GitHub account remained publicly accessible. OpenSourceMalware urged developers who built the branch to rotate credentials and inspect the generated lwd_uri_build_context.json file to see what had been collected.

The local JSON file provides the evidence trail when an outbound upload is blocked. Credential rotation addresses the possibility that the script read secrets, while file inspection shows what the process actually gathered. Neither step depends on proof that the POST to webhook.site completed.

With no patched release and no crate-wide yank as of Tuesday morning ET, the response window remains open until a clean replacement or withdrawal appears; developers who built the branch should continue to rotate credentials and inspect the generated file.