RUSTSEC-2026-0100
`pretty-changelog-logger` was removed from crates.io for malicious code
pretty-changelog-logger contains a build script (build.rs) that acts as a loader/dropper for malicious payloads.
The malicious crate had 3 versions published on 2026-04-08 that had a total of 2239 downloads. There were no crates depending on this crate on crates.io.
Thanks to Socket.dev for detecting and reporting this to the crates.io team!
What each source reports
OSV No score
`pretty-changelog-logger` was removed from crates.io for malicious code
pretty-changelog-logger contains a build script (build.rs) that acts as a loader/dropper for malicious payloads.
The malicious crate had 3 versions published on 2026-04-08 that had a total of 2239 downloads. There were no crates depending on this crate on crates.io.
Thanks to Socket.dev for detecting and reporting this to the crates.io team!
- Record
RUSTSEC-2026-0100- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pretty-changelog-loggercrates.io |
0.0.0-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0100 is a vulnerability with no CVSS score yet in pretty-changelog-logger, published April 13, 2026. No source lists public exploit code. No source names a fixed version.