CRITICAL

GHSA-xp79-9mxw-878j

`finch-rst` was removed from crates.io for malicious code

Details

This attempts to typosquat the existing crate [`finch`](https://crates.io/crates/finch) to steal credentials from local files.

The malicious crate had 1 version published on 2025-12-08 and had been downloaded 21 times. There were no crates depending on this crate on crates.io.

Thanks to Matthias Zepper of [NGI Sweden](https://ngisweden.scilifelab.se/) for reporting this to the crates.io team!

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/finch-rst

Introduced in: 0

No fixed version published yet for finch-rst. Pin to a known-safe version or switch to an alternative.

References

https://rustsec.org/advisories/RUSTSEC-2025-0150.html[WEB]