GitHub Advisoryadvisory · crates.io

GHSA-3mmg-7c2q-8938 `sha-rust` was removed from crates.io for malicious code

CRITICAL Published 2026-02-06 Modified 2026-02-06 Official page ↗

Ecosystem: crates.io
Packages: sha-rust
Severity: Critical
Reviewed: 2026-02-06

Affected packages

• crates.io sha-rust: all versions (no fix yet)

Description

It appeared to be attempting to steal credentials from local files.

References