acmer (>=0.0.1 <=0.0.16), dynamo-es (>=0.3.0 <=0.4.8) +11 more potentially affected by unknown CVE via aws-sdk-dynamodb (>=0.0.25-alpha <=0.9.0)

aws-sdk-dynamodb CARGO version =0.0.25-alpha, =0.0.1, =0.3.0, =0.1.0, =0.1.0, =0.8.0, =0.1.0, =0.3.0, =0.1.3, =0.0.1, =3.0.0, =4.2.8 - steel-plate =0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-G59M-GF8J-GJF5...

aws-secrets (>=0.1.0 <=0.1.1), aws-secretsmanager-cache (>=0.1.0 <=0.5.0) +4 more potentially affected by unknown CVE via aws-sdk-secretsmanager (>=0.0.25-alpha <=0.9.0)

aws-sdk-secretsmanager CARGO version =0.0.25-alpha, =0.1.0, =0.1.0, =0.1.0, =0.6.0, =2.0.0, =2.0.1 - secrets-manager-macro =0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-G59M-GF8J-GJF5...

acme-compilers (>=0.2.2 <=0.2.4), acvm (>=0.23.0 <=0.26.1) +286 more potentially affected by unknown CVE via rkyv (>=0.1.1 <=0.7.45)

rkyv CARGO version =0.1.1, =0.2.2, =0.23.0, =0.23.0, =0.0.1, =0.2.0, =0.39.0, =0.23.0, =0.26.1 - cairn-import-geonames =0.0.2-alpha - cairn-import-oa =0.0.2-alpha - cairn-import-osm =0.0.2-alpha - cairn-import-wof =0.0.2-alpha and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-00...

lunarbase-pmm-math (>=0.1.0 <=0.2.4), ruint-macro (=0.1.1) +5 more potentially affected by unknown CVE via ruint (>=0.1.0 <=1.16.0)

ruint CARGO version =0.1.0, =0.1.0, =0.3.0, =0.3.0, =0.1.0, =0.3.0, =0.1.0, =0.5.1 Source cves: unknown CVE Source advisory: OSV:GHSA-9FJQ-45QV-PCM7...

aperture-shared (=0.1.0), assemblylift-awslambda-host (>=0.2.0 <=0.3.0) +98 more potentially affected by unknown CVE via capnp (>=0.0.1 <=0.23.2)

capnp CARGO version =0.0.1, =0.2.0, =0.3.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.0.1, =0.1.0, =0.0.1, =0.4.0, =0.5.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0143...

lunarbase-pmm-math (>=0.1.0 <=0.2.4), ruint-macro (=0.1.1) +5 more potentially affected by unknown CVE via ruint (>=0.1.0 <=1.16.0)

ruint CARGO version =0.1.0, =0.1.0, =0.3.0, =0.3.0, =0.1.0, =0.3.0, =0.1.0, =0.5.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0137...

Cryptonic (>=0.1.0 <=0.1.2), IMAPServer (=0.1.0) +6348 more potentially affected by unknown CVE via bincode (>=0.0.1 <=3.0.0)

bincode CARGO version =0.0.1, =0.1.0, =0.19.0, =0.4.1, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0141...

card-backend-scdc (>=0.4.0 <=0.5.0), cfs_openpgp (=0.1.0) +43 more potentially affected by CVE-2025-67897 via sequoia-openpgp (>=0.11.0 <=1.22.0)

sequoia-openpgp CARGO version =0.11.0, =0.4.0, =0.0.1, =0.5.0, =0.3.0, =0.12.0, =0.1.0, =0.10.1, =0.10.1, =0.0.1, =0.0.1, =0.2.2 and more Source cves: CVE-2025-67897 Source advisory: OSV:GHSA-V6X3-9R38-R27Q...

ap-proxy-client (>=0.3.0 <=0.8.0), ap-proxy-protocol (>=0.3.0 <=0.8.0) +2 more potentially affected by CVE-2026-22705 via ml-dsa (=0.0.4)

ml-dsa CARGO version =0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on ml-dsa and may be impacted: - ap-proxy-client =0.3.0, =0.3.0, =0.1.0, =0.0.1-pre.0, =0.0.12 Source cves: CVE-2026-22705 Source advisory: OSV:RUSTSEC-2025-0144...

RUSTSEC-2025-0151 `sha-rst` was removed from crates.io for malicious code

This crate was used as a dependency by finchclirust and finch-rst and contained a malware payload to exfiltrate credentials. The malicious crate had 1 version published on 2025-12-08 and had been downloaded 22 times. Other than the other crates above that were part of the attack, no other crates...

RUSTSEC-2025-0150 `finch-rst` was removed from crates.io for malicious code

This attempts to typosquat the existing crate finch to steal credentials from local files. The malicious crate had 1 version published on 2025-12-08 and had been downloaded 21 times. There were no crates depending on this crate on crates.io. Thanks to Matthias Zepper of NGI Sweden for reporting...

`finch-rust` was removed from crates.io for malicious code

It depended on the sha-rust crate, which appeared to be attempting to steal credentials from local files...

`uniswap-utils` was removed from crates.io for malicious code

It depended on the evm-units crate, which appeared to be attempting to steal cryptocurrency...

RUSTSEC-2025-0145 `uniswap-utils` was removed from crates.io for malicious code

It depended on the evm-units crate, which appeared to be attempting to steal cryptocurrency...

RUSTSEC-2025-0147 `evm-units` was removed from crates.io for malicious code

It appeared to be attempting to steal cryptocurrency...

actix-web-location (>=0.1.0 <=0.7.0), bext-waf (=0.2.0) +18 more potentially affected by unknown CVE via maxminddb (>=0.12.0 <=0.24.0)

maxminddb CARGO version =0.12.0, =0.1.0, =0.1.3, =1.5.1, =0.1.0, =0.7.0, =0.4.0, =0.0.1, =0.1.8, =0.3.0, =0.5.0, =0.1.0, =0.1.0, =0.1.0, =0.5.7 and more Source cves: unknown CVE Source advisory: OSV:GHSA-MJ73-J457-8X9Q...

actix-web-location (>=0.1.0 <=0.7.0), bext-waf (=0.2.0) +18 more potentially affected by unknown CVE via maxminddb (>=0.12.0 <=0.24.0)

maxminddb CARGO version =0.12.0, =0.1.0, =0.1.3, =1.5.1, =0.1.0, =0.7.0, =0.4.0, =0.0.1, =0.1.8, =0.3.0, =0.5.0, =0.1.0, =0.1.0, =0.1.0, =0.5.7 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0132...

AskAI (=0.1.0), BiliupApi (>=0.1.0 <=0.1.7) +4220 more potentially affected by unknown CVE via rustls-pemfile (>=0.2.1 <=2.2.0)

rustls-pemfile CARGO version =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.7.0, =0.4.0, =0.21.0-alpha.1, =0.1.11, =0.11.0, =0.2.0, =0.5.1, =0.5.4 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0134...

actix-web-opentelemetry (>=0.2.0 <=0.17.0), atomic-server (>=0.32.1 <=0.34.0) +39 more potentially affected by unknown CVE via opentelemetry-jaeger (>=0.10.0 <=0.9.0)

opentelemetry-jaeger CARGO version =0.10.0, =0.2.0, =0.32.1, =0.2.1, =4.1.0, =0.1.0, =0.4.0-prerelease1, =0.3.2, =0.2.0-rc-8, =0.2.0-rc-9, =0.2.0-rc-10, =0.2.0-rc, =0.1.0, =0.31.0, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0123...

Boa (>=0.1.8 <=0.3.0), GetPDB (>=0.1.0 <=1.0.1) +5823 more potentially affected by unknown CVE via rand_os (>=0.1.3 <=0.2.2)

randos CARGO version =0.1.3, =0.1.8, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.6, =0.22.6, =0.1.0, =0.8.4 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0124...