Advisories for tracing{s,_checks}. (#2680)

Author: LawnGnome

crates/tracing_checks/RUSTSEC-0000-0000.md

@@ -0,0 +1,28 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "tracing_checks"
+date = "2026-02-26"
+expect-deleted = true
+
+[versions]
+patched = []
+```
+
+# `tracing_checks` was removed from crates.io for transitively including malicious code
+
+This is part of an ongoing campaign to attempt to typosquat crates in an
+attempt to exfiltrate Polymarket credentials.
+
+The malicious crate had 1 version published on 2026-02-26 approximately 9 hours
+before removal and had no evidence of actual usage, both in terms of downloads
+and dependents. It did not include the malware payload itself; this was instead
+delivered via the `tracings` crate, which has received a separate advisory.
+
+Thanks to Marko Ćupić for finding and reporting this to the Rust security
+response working group, and to Emily Albini for co-ordinating with the
+crates.io team.
+
+The crates.io team advises anyone developing with Polymarket to review
+dependencies carefully. We are investigating ways to mitigate this attacker who
+appears to be very motivated to steal Polymarket credentials.

crates/tracings/RUSTSEC-0000-0000.md

@@ -0,0 +1,28 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "tracings"
+date = "2026-02-26"
+expect-deleted = true
+
+[versions]
+patched = []
+```
+
+# `tracings` was removed from crates.io for malicious code
+
+This is part of an ongoing campaign to attempt to typosquat crates in an
+attempt to exfiltrate Polymarket credentials.
+
+The malicious crate had 1 version published on 2026-02-26 approximately 9 hours
+before removal and had no evidence of actual usage. The only crate depending on
+this crate was the `tracing_checks` crate, which was also part of this campaign
+and has received a separate advisory.
+
+Thanks to Marko Ćupić for finding and reporting this to the Rust security
+response working group, and to Emily Albini for co-ordinating with the
+crates.io team.
+
+The crates.io team advises anyone developing with Polymarket to review
+dependencies carefully. We are investigating ways to mitigate this attacker who
+appears to be very motivated to steal Polymarket credentials.