Vulnerability RUSTSEC-2026-0483
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
1 day ago
November 10, 2026 at 12:00 PM UTC
`lwd-uri-util` was removed from crates.io for malicious code
>=0.0.0-0
>=0.0.0-0
Summary
`lwd-uri-util` was removed from crates.io for malicious code
Details
The lwd-uri-util crate exfiltrated SSH keys, AWS credentials, and other environmental metadata and secrets when any crate using it was built.
The malicious crate had 8 versions published on 2026-11-09 approximately 12 hours before removal and had no evidence of actual usage. This crate had no dependencies on crates.io.
Thanks to Bitbison for the report.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Impacted packages
Timeline
Published
1 day ago
November 10, 2026 at 12:00 PM UTC
Last Modified
22 hours ago
November 11, 2026 at 08:45 AM UTC