—
RUSTSEC-2025-0156
`tree-sitter-pkl` was removed from crates.io for malicious code
Details
`tree-sitter-pkl` was part of a campaign that attempted to exfiltrate environmental data from the host.
The malicious crate had 1 version published in March 2025, and had no evidence of actual usage. This crate had no dependencies on crates.io.
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io/tree-sitter-pkl
Introduced in:
0.0.0-0No fixed version published yet for tree-sitter-pkl. Pin to a known-safe version or switch to an alternative.