RUSTSEC-2026-0263
`tinymember` was removed from crates.io due to affiliation with malicious code
While tinymember did not directly contain malicious code, it was owned by the
same user as arone and aronenao, which contained suspicious build scripts.
This crate had 2 versions published on 2026-08-18 that had a total of 27 downloads. There were no crates depending on this crate on crates.io. The crate was removed from crates.io and the user account was locked.
What each source reports
OSV No score
`tinymember` was removed from crates.io due to affiliation with malicious code
While tinymember did not directly contain malicious code, it was owned by the
same user as arone and aronenao, which contained suspicious build scripts.
This crate had 2 versions published on 2026-08-18 that had a total of 27 downloads. There were no crates depending on this crate on crates.io. The crate was removed from crates.io and the user account was locked.
- Record
RUSTSEC-2026-0263- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tinymembercrates.io |
0.0.0-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0263 is a vulnerability with no CVSS score yet in tinymember, published August 20, 2026. No source lists public exploit code. No source names a fixed version.