{
  "$type": "site.standard.document",
  "bskyPostRef": {
    "cid": "bafyreighdxp73rdevmringy2uvvfdfjdlsmvioy37trvchk7onwucqbivi",
    "uri": "at://did:plc:lujatorbzcq2chhxnvjgc464/app.bsky.feed.post/3mervuijvago2"
  },
  "path": "/2026/02/13/crates.io-malicious-crate-update/",
  "publishedAt": "2026-02-13T00:00:00.000Z",
  "site": "https://blog.rust-lang.org",
  "tags": [
    "RustSec",
    "RustSec advisory RSS feed",
    "our last blog post",
    "National Genomics Infrastructure Sweden",
    "RUSTSEC-2025-0150",
    "RUSTSEC-2025-0151",
    "RUSTSEC-2025-0152",
    "Socket",
    "RUSTSEC-2026-0010",
    "RUSTSEC-2026-0011",
    "Rust Foundation"
  ],
  "textContent": "The crates.io team will no longer publish a blog post each time a malicious crate is detected or reported. In the vast majority of cases to date, these notifications have involved crates that have no evidence of real world usage, and we feel that publishing these blog posts is generating noise, rather than signal.\n\nWe will always publish a RustSec advisory when a crate is removed for containing malware. You can subscribe to the RustSec advisory RSS feed to receive updates.\n\nCrates that contain malware _and_ are seeing real usage or exploitation will still get both a blog post and a RustSec advisory. We may also notify via additional communication channels (such as social media) if we feel it is warranted.\n\n##  Recent crates\n\nSince we are announcing this policy change now, here is a retrospective summary of the malicious crates removed since our last blog post and today:\n\n  * `finch_cli_rust`, `finch-rst`, and `sha-rst`: the Rust security response working group was notified on December 9th, 2025 by Matthias Zepper of National Genomics Infrastructure Sweden that these crates were attempting to exfiltrate credentials by impersonating the `finch` and `finch_cli` crates. Advisories: RUSTSEC-2025-0150, RUSTSEC-2025-0151, RUSTSEC-2025-0152.\n  * `polymarket-clients-sdk`: we were notified on February 6th by Socket that this crate was attempting to exfiltrate credentials by impersonating the `polymarket-client-sdk` crate. Advisory: RUSTSEC-2026-0010.\n  * `polymarket-client-sdks`: we were notified on February 13th that this crate was attempting to exfiltrate credentials by impersonating the `polymarket-client-sdk` crate. Advisory: RUSTSEC-2026-0011.\n\n\n\nIn all cases, the crates were deleted, the user accounts that published them were immediately disabled, and reports were made to upstream providers as appropriate.\n\n##  Thanks\n\nOnce again, our thanks go to Matthias, Socket, and the reporter of `polymarket-client-sdks` for their reports. We also want to thank Dirkjan Ochtman from the secure code working group, Emily Albini from the security response working group, and Walter Pearce from the Rust Foundation for aiding in the response.",
  "title": "crates.io: an update to the malicious crate notification policy",
  "updatedAt": "2026-02-13T00:00:00.000Z"
}