---
title: "GHSA-f8h5-x737-x4xr: `finch-rust` was removed from crates.io for malicious code"
url: https://erroneo.us/security/ghsa/GHSA-f8h5-x737-x4xr/
description: "GHSA-f8h5-x737-x4xr (critical, crates.io (Rust)): finch-rust was removed from crates.io for malicious code. It depended on the sha-rust crate, which…"
type: advisory
section: "Security Digest"
date_published: 2026-02-06
date_modified: 2026-02-06
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-f8h5-x737-x4xr"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-f8h5-x737-x4xr: `finch-rust` was removed from crates.io for malicious code

## Affected packages

- crates.io (Rust) `finch-rust` >= 0 → fixed: none listed

## Details

It depended on the sha-rust crate, which appeared to be attempting to steal credentials from local files.

## Sources

- [GitHub Advisory GHSA-f8h5-x737-x4xr](https://github.com/advisories/GHSA-f8h5-x737-x4xr)
- [blog.rust-lang.org](https://blog.rust-lang.org/2025/12/05/crates.io-malicious-crates-finch-rust-and-sha-rust)
- [rustsec.org](https://rustsec.org/advisories/RUSTSEC-2025-0148.html)

---
Source page: https://erroneo.us/security/ghsa/GHSA-f8h5-x737-x4xr/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt