Add advisory for polymarkets-rs-clob-client.

Author: LawnGnome

crates/polymarkets-rs-clob-client/RUSTSEC-0000-0000.md

@@ -0,0 +1,27 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "polymarkets-rs-clob-client"
+date = "2026-02-20"
+expect-deleted = true
+
+[versions]
+patched = []
+```
+
+# `polymarkets-rs-clob-client` was removed from crates.io for malicious code
+
+This is part of an ongoing campaign to attempt to typosquat crates in the
+[`polymarket-client-sdk`](https://crates.io/crates/polymarket-client-sdk)
+ecosystem to exfiltrate user credentials.
+
+The malicious crate had 1 version published on 2026-02-19 approximately 20
+hours before removal and had no evidence of actual downloads. There were no
+crates depending on this crate on crates.io.
+
+Thanks to Adam Harvey at the Rust Foundation, who is awkwardly thanking himself
+in this instance.
+
+The crates.io team advises anyone developing with Polymarket to review
+dependencies carefully. We are investigating ways to mitigate this attacker who
+appears to be very motivated to steal Polymarket credentials.