Skip to content

Commit 759ed4e

Browse files
committed
Add the newest crate, and update the date.
1 parent 65a60b6 commit 759ed4e

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

content/crates.io-malicious-crate-update.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
+++
2-
path = "2026/02/12/crates.io-malicious-crate-update"
2+
path = "2026/02/13/crates.io-malicious-crate-update"
33
title = "crates.io: an update to the malicious crate notification policy"
44
authors = ["Adam Harvey"]
55

@@ -20,17 +20,19 @@ Since we are announcing this policy change now, here is a retrospective summary
2020

2121
- `finch_cli_rust`, `finch-rst`, and `sha-rst`: the Rust security response working group was notified on December 9th, 2025 by Matthias Zepper of [National Genomics Infrastructure Sweden][ngi-sweden] that these crates were attempting to exfiltrate credentials by impersonating the `finch` and `finch_cli` crates. Advisories: [RUSTSEC-2025-0150][advisory-finch-rst], [RUSTSEC-2025-0151][advisory-sha-rst], [RUSTSEC-2025-0152][advisory-finch-cli-rust].
2222
- `polymarket-clients-sdk`: we were notified on February 6th by [Socket][socket] that this crate was attempting to exfiltrate credentials by impersonating the `polymarket-client-sdk` crate. Advisory: [RUSTSEC-2026-0010][advisory-polymarket].
23+
- `polymarket-client-sdks`: we were notified on February 13th that this crate was attempting to exfiltrate credentials by impersonating the `polymarket-client-sdk` crate. Advisory: [RUSTSEC-2026-0011][advisory-polymarket-deux].
2324

2425
In all cases, the crates were deleted, the user accounts that published them were immediately disabled, and reports were made to upstream providers as appropriate.
2526

2627
## Thanks
2728

28-
Once again, our thanks go to Matthias and Socket for their reports. We also want to thank Dirkjan Ochtman from the secure code working group, Emily Albini from the security response working group, and Walter Pearce from the [Rust Foundation][foundation] for aiding in the response.
29+
Once again, our thanks go to Matthias, Socket, and the reporter of `polymarket-client-sdks` for their reports. We also want to thank Dirkjan Ochtman from the secure code working group, Emily Albini from the security response working group, and Walter Pearce from the [Rust Foundation][foundation] for aiding in the response.
2930

3031
[advisory-finch-cli-rust]: https://rustsec.org/advisories/RUSTSEC-2025-0152.html
3132
[advisory-finch-rst]: https://rustsec.org/advisories/RUSTSEC-2025-0150.html
3233
[advisory-sha-rst]: https://rustsec.org/advisories/RUSTSEC-2025-0151.html
3334
[advisory-polymarket]: https://rustsec.org/advisories/RUSTSEC-2026-0010.html
35+
[advisory-polymarket-deux]: https://rustsec.org/advisories/RUSTSEC-2026-0011.html
3436
[foundation]: https://foundation.rust-lang.org/
3537
[last-post]: https://blog.rust-lang.org/2025/12/05/crates.io-malicious-crates-finch-rust-and-sha-rust/
3638
[ngi-sweden]: https://ngisweden.scilifelab.se/

0 commit comments

Comments
 (0)