GitHub Advisoryadvisory · crates.io

GHSA-g38r-8gmr-ghrf `mysten-metrics` was removed from crates.io for malicious code

CRITICAL Published 2026-05-04 Modified 2026-05-04 Official page ↗
Ecosystem
crates.io
Packages
mysten-metrics
Severity
Critical
Weaknesses
CWE-506
Reviewed
2026-05-04

Affected packages

• crates.io mysten-metrics: all versions (no fix yet)

Description

`mysten-metrics` included a build script that attempted to exfiltrate data from the build machine. The malicious crate had 1 version published on 2026-04-20 and had no evidence of actual usage. This crate had no dependencies on crates.io.

Related

Weakness · CWE (1)

  • CWE-506 Embedded Malicious Code weakness

References