RUSTSEC-2026-0014
`rpc-check` was removed from crates.io for malicious code
It was attempting to steal credentials from the POLYMARKET_PRIVATE_KEY environment variable.
The malicious crate had 3 versions published on 2026-02-15 and had been downloaded only 155 times. There were no crates depending on this crate on crates.io.
Thanks to Sisong Li for finding and reporting this to the crates.io team!
What each source reports
OSV No score
`rpc-check` was removed from crates.io for malicious code
It was attempting to steal credentials from the POLYMARKET_PRIVATE_KEY environment variable.
The malicious crate had 3 versions published on 2026-02-15 and had been downloaded only 155 times. There were no crates depending on this crate on crates.io.
Thanks to Sisong Li for finding and reporting this to the crates.io team!
- Record
RUSTSEC-2026-0014- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rpc-checkcrates.io |
0.0.0-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0014 is a vulnerability with no CVSS score yet in rpc-check, published February 19, 2026. No source lists public exploit code. No source names a fixed version.