CRITICAL

GHSA-6v2j-vr4h-f632

`finch_cli_rust` was removed from crates.io for malicious code

Details

This attempts to typosquat the existing crate [`finch_cli`](https://crates.io/crates/finch_cli) to steal credentials from local files.

The malicious crate had 1 version published on 2025-12-08 and had been downloaded 18 times. There were no crates depending on this crate on crates.io.

Thanks to Matthias Zepper of [NGI Sweden](https://ngisweden.scilifelab.se/) for reporting this to the crates.io team!

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/finch_cli_rust

Introduced in: 0

No fixed version published yet for finch_cli_rust. Pin to a known-safe version or switch to an alternative.

References

https://rustsec.org/advisories/RUSTSEC-2025-0152.html[WEB]