crates.io: Malicious crates finch-rust and sha-rust

· The Rust Programming Language · Dec. 5, 2025, 6:31 p.m.
Security dependency management Malware Prevention Rust Programming
Summary
On December 5th, crates.io took action against two malicious crates, finch-rust and sha-rust, reported for attempting to confuse users and perform data exfiltration. The threat was identified by Kush Pandya from the Socket Threat Research Team. Following the report, the user was disabled, and the crates were deleted quickly to prevent any potential harm. An analysis indicates no evidence of these crates being widely downloaded.
Read full post on blog.rust-lang.org →
AUTHOR
Advertise
Sponsor diff.blog
Put your product in front of developers who read and write about their craft. One exclusive sponsor at a time.
Become a sponsor →
BLOG POST FEATURED ON

Placeholder image
r/rustlanges

1 points

Add this plugin to your blog