GitHub Advisoryadvisory · crates.io

GHSA-f8h5-x737-x4xr `finch-rust` was removed from crates.io for malicious code

CRITICAL Published 2026-02-06 Modified 2026-02-06 Official page ↗

Ecosystem: crates.io
Packages: finch-rust
Severity: Critical
Reviewed: 2026-02-06

Affected packages

• crates.io finch-rust: all versions (no fix yet)

Description

It depended on the `sha-rust` crate, which appeared to be attempting to steal credentials from local files.

References