Security Digest · Critical advisory (no CVE assigned)
GHSA-6662-54xr-8423: `evm-units` was removed from crates.io for malicious code
It appeared to be attempting to steal cryptocurrency.
GitHub-reviewed · critical
Should you act?
- Malicious code, not a bug. If any listed version was ever installed, assume the machine and every secret on it are compromised: remove it, rotate credentials, rebuild.
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
cargo audit. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| crates.io (Rust) | evm-units | >= 0 | none listed |
Details
It appeared to be attempting to steal cryptocurrency.
Sources and references
- GitHub Advisory GHSA-6662-54xr-8423 github.com
- blog.rust-lang.org blog.rust-lang.org
- rustsec.org rustsec.org
Critical crates.io (Rust) advisories · Today’s Security Digest