{"id":"GHSA-g38r-8gmr-ghrf","summary":"`mysten-metrics` was removed from crates.io for malicious code","details":"`mysten-metrics` included a build script that attempted to exfiltrate data from the build machine.\n\nThe malicious crate had 1 version published on 2026-04-20 and had no evidence of actual usage. This crate had no dependencies on crates.io.","aliases":["RUSTSEC-2026-0107"],"modified":"2026-05-06T06:56:26.201706969Z","published":"2026-05-04T21:43:56Z","database_specific":{"github_reviewed_at":"2026-05-04T21:43:56Z","nvd_published_at":null,"cwe_ids":["CWE-506"],"severity":"CRITICAL","github_reviewed":true},"references":[{"type":"PACKAGE","url":"https://github.com/MystenLabs/sui"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0107.html"}],"affected":[{"package":{"name":"mysten-metrics","ecosystem":"crates.io","purl":"pkg:cargo/mysten-metrics"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-g38r-8gmr-ghrf/GHSA-g38r-8gmr-ghrf.json"}}],"schema_version":"1.9.0"}