Vulnerability RUSTSEC-2026-0470
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
1 day ago
November 09, 2026 at 12:00 PM UTC
`gabby-types-sec` was removed from crates.io for malicious code
>=0.0.0-0
>=0.0.0-0
Summary
`gabby-types-sec` was removed from crates.io for malicious code
Details
gabby-types-sec attempted to send telemetry from the build environment to an arbitrary URL.
The malicious crate had 1 version published on 2026-02-17, approximately 9 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io.
Thanks to Bitbison for the report.
References
Impacted packages
Timeline
Published
1 day ago
November 09, 2026 at 12:00 PM UTC
Last Modified
15 hours ago
November 10, 2026 at 01:00 PM UTC