RUSTSEC-2026-0281
`greentic-setup` 1.3.1-dev.34027618345 was removed from crates.io due to containing malicious code
A new version of the greentic-setup crate was published with a variant
of the PolinRider malware included that would fire when a project
depending on greentic-setup was opened in Visual Studio Code.
One malicious version was published on 2026-09-06, approximately 27 hours
before removal. This crate is depended on by four other crates in the
Greentic ecosystem, namely greentic-start, greentic-start-dev,
greentic-operator, and greentic-operator-dev. We have no evidence that this
crate version was downloaded by any actual users, but Greentic users should
check their systems nonetheless.
Thanks to the Research Team at Nextron Systems GmbH for the report.
What each source reports
OSVNo score
`greentic-setup` 1.3.1-dev.34027618345 was removed from crates.io due to containing malicious code
A new version of the greentic-setup crate was published with a variant
of the PolinRider malware included that would fire when a project
depending on greentic-setup was opened in Visual Studio Code.
One malicious version was published on 2026-09-06, approximately 27 hours
before removal. This crate is depended on by four other crates in the
Greentic ecosystem, namely greentic-start, greentic-start-dev,
greentic-operator, and greentic-operator-dev. We have no evidence that this
crate version was downloaded by any actual users, but Greentic users should
check their systems nonetheless.
Thanks to the Research Team at Nextron Systems GmbH for the report.
- Record
RUSTSEC-2026-0281- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
greentic-setupcrates.io | 1.3.1-dev.34027618345 up to 1.3.1-dev.34027618345.0 | 1.3.1-dev.34027618345.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0281 is a vulnerability with no CVSS score yet in greentic-setup, published September 7, 2026. No source lists public exploit code. Fixed in greentic-setup 1.3.1-dev.34027618345.0.