From 555af38143be3f9ffa33919f49f98919fd4c8d10 Mon Sep 17 00:00:00 2001
From: Adam Harvey <adam@adamharvey.name>
Date: Wed, 10 Jun 2026 12:00:31 -0700
Subject: [PATCH] Add malware advisory for onering 1.4.1 (#2953)

---
 crates/onering/RUSTSEC-0000-0000.md | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 crates/onering/RUSTSEC-0000-0000.md

diff --git a/crates/onering/RUSTSEC-0000-0000.md b/crates/onering/RUSTSEC-0000-0000.md
new file mode 100644
index 000000000..19e37e94d
--- /dev/null
+++ b/crates/onering/RUSTSEC-0000-0000.md
@@ -0,0 +1,22 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "onering"
+date = "2026-06-10"
+categories = ["malicious"]
+
+[versions]
+unaffected = ["< 1.4.1", "> 1.4.1"]
+patched = []
+```
+
+# `onering` 1.4.1 was removed from crates.io for malicious code
+
+A new version of the `onering` crate was published with code that attempted to
+exfiltrate both metadata and code from the project it was included within.
+
+One malicious version was published on 2026-06-10, approximately six hours
+before removal. This crate has no dependencies on crates.io, and there is no
+evidence of actual usage of the compromised version.
+
+Thanks to Charlie Eriksen for the report.