Vulnerability RUSTSEC-2026-0468
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
4 days ago
November 06, 2026 at 12:00 PM UTC
`shinchina` was removed from crates.io for malicious code
>=0.0.0-0
>=0.0.0-0
Summary
`shinchina` was removed from crates.io for malicious code
Details
shinchina attempted to send telemetry from the build environment to an arbitrary URL.
The malicious crate had 1 version published on 2025-03-01, approximately 20 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io.
Thanks to Bitbison for the report.
References
Impacted packages
Timeline
Published
4 days ago
November 06, 2026 at 12:00 PM UTC
Last Modified
15 hours ago
November 10, 2026 at 01:00 PM UTC