GitHub Advisoryadvisory · crates.io

GHSA-xp79-9mxw-878j `finch-rst` was removed from crates.io for malicious code

CRITICAL Published 2026-02-12 Modified 2026-02-12 Official page ↗
Ecosystem
crates.io
Packages
finch-rst
Severity
Critical
Weaknesses
CWE-506
Reviewed
2026-02-12

Affected packages

• crates.io finch-rst: all versions (no fix yet)

Description

This attempts to typosquat the existing crate `finch` to steal credentials from local files. The malicious crate had 1 version published on 2025-12-08 and had been downloaded 21 times. There were no crates depending on this crate on crates.io. Thanks to Matthias Zepper of NGI Sweden for reporting this to the crates.io team!

Related

Weakness · CWE (1)

  • CWE-506 Embedded Malicious Code weakness

References