Security Digest · Critical advisory (no CVE assigned)
GHSA-qprh-m6p3-hwxc: `sui-execution-cut` was removed from crates.io for malicious code
sui-execution-cut included a build script that attempted to exfiltrate data from the build machine.
GitHub-reviewed · critical
Should you act?
- Malicious code, not a bug. If any listed version was ever installed, assume the machine and every secret on it are compromised: remove it, rotate credentials, rebuild.
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
cargo audit. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| crates.io (Rust) | sui-execution-cut | >= 0 | none listed |
Details
sui-execution-cut included a build script that attempted to exfiltrate data from the build machine.
The malicious crate had 1 version published on 2026-04-20 and had no evidence of actual usage. This crate had no dependencies on crates.io.
Sources and references
- GitHub Advisory GHSA-qprh-m6p3-hwxc github.com
- rustsec.org rustsec.org
Critical crates.io (Rust) advisories · Today’s Security Digest