CRITICAL
GHSA-vgr2-r5hm-f6gf
`sha-rst` was removed from crates.io for malicious code
Details
This crate was used as a dependency by `finch_cli_rust` and `finch-rst` and contained a malware payload to exfiltrate credentials.
The malicious crate had 1 version published on 2025-12-08 and had been downloaded 22 times. Other than the other crates above that were part of the attack, no other crates depedended on this crate.
Thanks to Matthias Zepper of [NGI Sweden](https://ngisweden.scilifelab.se/) for reporting this to the crates.io team!
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io/sha-rst
Introduced in:
0No fixed version published yet for sha-rst. Pin to a known-safe version or switch to an alternative.