Summary
On December 5th, crates.io took action against two malicious crates, finch-rust and sha-rust, reported for attempting to confuse users and perform data exfiltration. The threat was identified by Kush Pandya from the Socket Threat Research Team. Following the report, the user was disabled, and the crates were deleted quickly to prevent any potential harm. An analysis indicates no evidence of these crates being widely downloaded.