rustsec/advisory-db
1
0
Fork 0
mirror of https://github.com/rustsec/advisory-db.git synced 2026-07-16 00:12:29 -04:00
Code Issues Packages Projects Releases Wiki Activity

Assigned RUSTSEC-2023-0097 to lazystatic, RUSTSEC-2023-0098 to if-cfg, RUSTSEC-2023-0099 to envlogger, RUSTSEC-2023-0100 to xrvrv, RUSTSEC-2023-0101 to oncecell, RUSTSEC-2023-0102 to serd, RUSTSEC-2023-0103 to postgress

Browse Source
This commit is contained in:
LawnGnome
2026-03-19 20:39:17 +00:00
committed by Adam Harvey
parent 90c32bcae7
commit 4ca5630223
8 changed files with 148 additions and 148 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.duplicate-id-guard
View File

@@ -1,3 +1,3 @@
This file causes merge conflicts if two ID assignment jobs run concurrently.
This prevents duplicate ID assignment due to a race between those jobs.
e60d6bb8f86955bec513d8a9205d803fbffdf187116af4a3003fa3f5dd08a13c -
54916b3421c30929d127132a061e0436bd9c9c395bec90db21c16c74f78dcab4 -

42
crates/envlogger/RUSTSEC-0000-0000.md → crates/envlogger/RUSTSEC-2023-0099.md
View File

@@ -1,21 +1,21 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "envlogger"
date = "2023-08-16"
expect-deleted = true
references = ["https://www.veracode.com/blog/rust-malware-staged-on-crates-io/"]
categories = ["malicious"]
[versions]
patched = []
```
# `envlogger` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user `amaperf` and contained a malware payload in build.rs to exfiltrate host information to the attacker.
This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available. The related malicious crates have been yanked, and the malicious account has been banned.
Thanks to [Veracode](https://www.veracode.com/) (formerly phylum)for
reporting this to the crates.io team!
```toml
[advisory]
id = "RUSTSEC-2023-0099"
package = "envlogger"
date = "2023-08-16"
expect-deleted = true
references = ["https://www.veracode.com/blog/rust-malware-staged-on-crates-io/"]
categories = ["malicious"]
[versions]
patched = []
```
# `envlogger` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user `amaperf` and contained a malware payload in build.rs to exfiltrate host information to the attacker.
This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available. The related malicious crates have been yanked, and the malicious account has been banned.
Thanks to [Veracode](https://www.veracode.com/) (formerly phylum)for
reporting this to the crates.io team!

42
crates/if-cfg/RUSTSEC-0000-0000.md → crates/if-cfg/RUSTSEC-2023-0098.md
View File

@@ -1,21 +1,21 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "if-cfg"
date = "2023-08-16"
expect-deleted = true
references = ["https://www.veracode.com/blog/rust-malware-staged-on-crates-io/"]
categories = ["malicious"]
[versions]
patched = []
```
# `if-cfg` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user `amaperf` and contained a malware payload in build.rs to exfiltrate host information to the attacker.
This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available. The related malicious crates have been yanked, and the malicious account has been banned.
Thanks to [Veracode](https://www.veracode.com/) (formerly phylum)for
reporting this to the crates.io team!
```toml
[advisory]
id = "RUSTSEC-2023-0098"
package = "if-cfg"
date = "2023-08-16"
expect-deleted = true
references = ["https://www.veracode.com/blog/rust-malware-staged-on-crates-io/"]
categories = ["malicious"]
[versions]
patched = []
```
# `if-cfg` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user `amaperf` and contained a malware payload in build.rs to exfiltrate host information to the attacker.
This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available. The related malicious crates have been yanked, and the malicious account has been banned.
Thanks to [Veracode](https://www.veracode.com/) (formerly phylum)for
reporting this to the crates.io team!

42
crates/lazystatic/RUSTSEC-0000-0000.md → crates/lazystatic/RUSTSEC-2023-0097.md
View File

@@ -1,21 +1,21 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "lazystatic"
date = "2023-08-16"
expect-deleted = true
references = ["https://www.veracode.com/blog/rust-malware-staged-on-crates-io/"]
categories = ["malicious"]
[versions]
patched = []
```
# `lazystatic` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user `amaperf` and contained a malware payload in build.rs to exfiltrate host information to the attacker.
This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available. The related malicious crates have been yanked, and the malicious account has been banned.
Thanks to [Veracode](https://www.veracode.com/) (formerly phylum)for
reporting this to the crates.io team!
```toml
[advisory]
id = "RUSTSEC-2023-0097"
package = "lazystatic"
date = "2023-08-16"
expect-deleted = true
references = ["https://www.veracode.com/blog/rust-malware-staged-on-crates-io/"]
categories = ["malicious"]
[versions]
patched = []
```
# `lazystatic` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user `amaperf` and contained a malware payload in build.rs to exfiltrate host information to the attacker.
This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available. The related malicious crates have been yanked, and the malicious account has been banned.
Thanks to [Veracode](https://www.veracode.com/) (formerly phylum)for
reporting this to the crates.io team!

42
crates/oncecell/RUSTSEC-0000-0000.md → crates/oncecell/RUSTSEC-2023-0101.md
View File

@@ -1,21 +1,21 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "oncecell"
date = "2023-08-16"
expect-deleted = true
references = ["https://www.veracode.com/blog/rust-malware-staged-on-crates-io/"]
categories = ["malicious"]
[versions]
patched = []
```
# `oncecell` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user `amaperf` and contained a malware payload in build.rs to exfiltrate host information to the attacker.
This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available. The related malicious crates have been yanked, and the malicious account has been banned.
Thanks to [Veracode](https://www.veracode.com/) (formerly phylum)for
reporting this to the crates.io team!
```toml
[advisory]
id = "RUSTSEC-2023-0101"
package = "oncecell"
date = "2023-08-16"
expect-deleted = true
references = ["https://www.veracode.com/blog/rust-malware-staged-on-crates-io/"]
categories = ["malicious"]
[versions]
patched = []
```
# `oncecell` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user `amaperf` and contained a malware payload in build.rs to exfiltrate host information to the attacker.
This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available. The related malicious crates have been yanked, and the malicious account has been banned.
Thanks to [Veracode](https://www.veracode.com/) (formerly phylum)for
reporting this to the crates.io team!

42
crates/postgress/RUSTSEC-0000-0000.md → crates/postgress/RUSTSEC-2023-0103.md
View File

@@ -1,21 +1,21 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "postgress"
date = "2023-08-16"
expect-deleted = true
references = ["https://www.veracode.com/blog/rust-malware-staged-on-crates-io/"]
categories = ["malicious"]
[versions]
patched = []
```
# `postgress` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user `amaperf` and contained a malware payload in build.rs to exfiltrate host information to the attacker.
This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available. The related malicious crates have been yanked, and the malicious account has been banned.
Thanks to [Veracode](https://www.veracode.com/) (formerly phylum)for
reporting this to the crates.io team!
```toml
[advisory]
id = "RUSTSEC-2023-0103"
package = "postgress"
date = "2023-08-16"
expect-deleted = true
references = ["https://www.veracode.com/blog/rust-malware-staged-on-crates-io/"]
categories = ["malicious"]
[versions]
patched = []
```
# `postgress` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user `amaperf` and contained a malware payload in build.rs to exfiltrate host information to the attacker.
This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available. The related malicious crates have been yanked, and the malicious account has been banned.
Thanks to [Veracode](https://www.veracode.com/) (formerly phylum)for
reporting this to the crates.io team!

42
crates/serd/RUSTSEC-0000-0000.md → crates/serd/RUSTSEC-2023-0102.md
View File

@@ -1,21 +1,21 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "serd"
date = "2023-08-16"
expect-deleted = true
references = ["https://www.veracode.com/blog/rust-malware-staged-on-crates-io/"]
categories = ["malicious"]
[versions]
patched = []
```
# `serd` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user `amaperf` and contained a malware payload in build.rs to exfiltrate host information to the attacker.
This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available. The related malicious crates have been yanked, and the malicious account has been banned.
Thanks to [Veracode](https://www.veracode.com/) (formerly phylum)for
reporting this to the crates.io team!
```toml
[advisory]
id = "RUSTSEC-2023-0102"
package = "serd"
date = "2023-08-16"
expect-deleted = true
references = ["https://www.veracode.com/blog/rust-malware-staged-on-crates-io/"]
categories = ["malicious"]
[versions]
patched = []
```
# `serd` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user `amaperf` and contained a malware payload in build.rs to exfiltrate host information to the attacker.
This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available. The related malicious crates have been yanked, and the malicious account has been banned.
Thanks to [Veracode](https://www.veracode.com/) (formerly phylum)for
reporting this to the crates.io team!

42
crates/xrvrv/RUSTSEC-0000-0000.md → crates/xrvrv/RUSTSEC-2023-0100.md
View File

@@ -1,21 +1,21 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "xrvrv"
date = "2023-08-16"
expect-deleted = true
references = ["https://www.veracode.com/blog/rust-malware-staged-on-crates-io/"]
categories = ["malicious"]
[versions]
patched = []
```
# `xrvrv` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user `amaperf` and contained a malware payload in build.rs to exfiltrate host information to the attacker.
This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available. The related malicious crates have been yanked, and the malicious account has been banned.
Thanks to [Veracode](https://www.veracode.com/) (formerly phylum)for
reporting this to the crates.io team!
```toml
[advisory]
id = "RUSTSEC-2023-0100"
package = "xrvrv"
date = "2023-08-16"
expect-deleted = true
references = ["https://www.veracode.com/blog/rust-malware-staged-on-crates-io/"]
categories = ["malicious"]
[versions]
patched = []
```
# `xrvrv` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user `amaperf` and contained a malware payload in build.rs to exfiltrate host information to the attacker.
This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available. The related malicious crates have been yanked, and the malicious account has been banned.
Thanks to [Veracode](https://www.veracode.com/) (formerly phylum)for
reporting this to the crates.io team!