RUSTSEC-2026-0040
`tracing-ethers` was removed from crates.io due to malicious code
The tracing-ethers crate attempted to exfiltrate ssh keys to an app hosted on vercel.app
The malicious crate had 9 version published on 2026-03-09 approximately 5 days before removal and had no evidence of actual downloads. There were no crates depending on this crate on crates.io.
Thanks to the user killa for reporting this malicious crate.
What each source reports
OSV No score
`tracing-ethers` was removed from crates.io due to malicious code
The tracing-ethers crate attempted to exfiltrate ssh keys to an app hosted on vercel.app
The malicious crate had 9 version published on 2026-03-09 approximately 5 days before removal and had no evidence of actual downloads. There were no crates depending on this crate on crates.io.
Thanks to the user killa for reporting this malicious crate.
- Record
RUSTSEC-2026-0040- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tracing-etherscrates.io |
0.0.0-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0040 is a vulnerability with no CVSS score yet in tracing-ethers, published March 14, 2026. No source lists public exploit code. No source names a fixed version.