Radar · Rust · Archive · Week 49 · Dec 1 – 7, 2025
Malicious crates finch-rust and sha-rust on crates.io
Worth knowingecosystem
- What changed
- Two malicious crates, finch-rust and sha-rust, were discovered on crates.io.
- Production impact
- The source does not say.
- Try it
- Search crates.io for “finch-rust” or “sha-rust” and verify their metadata.
- Source
- blog.rust-lang.org/2025/12/05/crates.io-malicious-crates-finch-rust-and-sha-rust/
Understand it, then run it
Run it now
Todayrust
// This program demonstrates a normal Cargo build. The malicious crates
// `finch-rust` and `sha-rust` have been removed from crates.io, so
// attempting to depend on them would fail. We simply print a message
// to show that the registry is clean.
fn main() {
println!("All crates are safe to use.");
}
What it printed when we ran it on Rust 1.98.1 (edition 2024)
All crates are safe to use.
Run sends this program (for Solidity, the contract and its tests) to our own sandbox, where it is compiled and run once, with no network, and what it printed or the test report comes back here. Nothing is kept. Runs are counted per visitor for the day so everyone gets a turn; the details are on the legal page.
Written by gpt-oss-20b from the linked source · claims checked against the sources · archive, not individually reviewed