{"id":"RUSTSEC-2026-0175","aliases":[],"status":"published","title":"`onering` 1.4.1 was removed from crates.io for malicious code","description":"A new version of the `onering` crate was published with code that attempted to\nexfiltrate both metadata and code from the project it was included within.\n\nOne malicious version was published on 2026-06-10, approximately six hours\nbefore removal. This crate has no dependencies on crates.io, and there is no\nevidence of actual usage of the compromised version.\n\nThanks to Charlie Eriksen for the report.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-06-10T12:00:00Z","modified":"2026-09-22T15:16:11Z","fixes":[{"ecosystem":"crates.io","package":"onering","fixed_in":["1.4.2-0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"onering","ranges":[{"type":"SEMVER","events":[{"introduced":"1.4.1"},{"fixed":"1.4.2-0"}]}]}],"references":[{"url":"https://crates.io/crates/onering","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0175.html","tags":["advisory"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0175","title":"`onering` 1.4.1 was removed from crates.io for malicious code","description":"A new version of the `onering` crate was published with code that attempted to\nexfiltrate both metadata and code from the project it was included within.\n\nOne malicious version was published on 2026-06-10, approximately six hours\nbefore removal. This crate has no dependencies on crates.io, and there is no\nevidence of actual usage of the compromised version.\n\nThanks to Charlie Eriksen for the report.","status":"published","published":"2026-06-10T12:00:00Z","modified":"2026-09-22T15:16:11Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}