diff --git a/crates/chrono_anchor/RUSTSEC-2026-0039.md b/crates/chrono_anchor/RUSTSEC-2026-0039.md
index c65966f5..a573bac0 100644
--- a/crates/chrono_anchor/RUSTSEC-2026-0039.md
+++ b/crates/chrono_anchor/RUSTSEC-2026-0039.md
@@ -4,6 +4,7 @@ id = "RUSTSEC-2026-0039"
 package = "chrono_anchor"
 date = "2026-03-10"
 expect-deleted = true
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/clob-sdk/RUSTSEC-2026-0017.md b/crates/clob-sdk/RUSTSEC-2026-0017.md
index 43d12aa7..a3884ee5 100644
--- a/crates/clob-sdk/RUSTSEC-2026-0017.md
+++ b/crates/clob-sdk/RUSTSEC-2026-0017.md
@@ -4,6 +4,7 @@ id = "RUSTSEC-2026-0017"
 package = "clob-sdk"
 date = "2026-02-20"
 expect-deleted = true
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/dnp3times/RUSTSEC-2026-0032.md b/crates/dnp3times/RUSTSEC-2026-0032.md
index 318c0489..3450eb46 100644
--- a/crates/dnp3times/RUSTSEC-2026-0032.md
+++ b/crates/dnp3times/RUSTSEC-2026-0032.md
@@ -5,6 +5,7 @@ package = "dnp3times"
 date = "2026-03-04"
 expect-deleted = true
 aliases = ["GHSA-xhw7-jhmp-j62j"]
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/evm-units/RUSTSEC-2025-0147.md b/crates/evm-units/RUSTSEC-2025-0147.md
index b7ec0ea6..79fb06d0 100644
--- a/crates/evm-units/RUSTSEC-2025-0147.md
+++ b/crates/evm-units/RUSTSEC-2025-0147.md
@@ -7,6 +7,7 @@ url = "https://blog.rust-lang.org/2025/12/03/crates.io-malicious-crates-evm-unit
 references = ["https://socket.dev/blog/malicious-rust-crate-evm-units-serves-cross-platform-payloads"]
 expect-deleted = true
 aliases = ["GHSA-6662-54xr-8423"]
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/finch-rst/RUSTSEC-2025-0150.md b/crates/finch-rst/RUSTSEC-2025-0150.md
index eded4cde..91c98898 100644
--- a/crates/finch-rst/RUSTSEC-2025-0150.md
+++ b/crates/finch-rst/RUSTSEC-2025-0150.md
@@ -5,6 +5,7 @@ package = "finch-rst"
 date = "2025-12-09"
 expect-deleted = true
 aliases = ["GHSA-xp79-9mxw-878j"]
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/finch-rust/RUSTSEC-2025-0148.md b/crates/finch-rust/RUSTSEC-2025-0148.md
index b5fa53df..08d0108c 100644
--- a/crates/finch-rust/RUSTSEC-2025-0148.md
+++ b/crates/finch-rust/RUSTSEC-2025-0148.md
@@ -7,6 +7,7 @@ url = "https://blog.rust-lang.org/2025/12/05/crates.io-malicious-crates-finch-ru
 references = ["https://socket.dev/blog/malicious-crate-mimicking-finch-exfiltrates-credentials"]
 expect-deleted = true
 aliases = ["GHSA-f8h5-x737-x4xr"]
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/finch_cli_rust/RUSTSEC-2025-0152.md b/crates/finch_cli_rust/RUSTSEC-2025-0152.md
index 68706bc5..a5c35a0d 100644
--- a/crates/finch_cli_rust/RUSTSEC-2025-0152.md
+++ b/crates/finch_cli_rust/RUSTSEC-2025-0152.md
@@ -5,6 +5,7 @@ package = "finch_cli_rust"
 date = "2025-12-09"
 expect-deleted = true
 aliases = ["GHSA-6v2j-vr4h-f632"]
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/polymarket-client-sdks/RUSTSEC-2026-0011.md b/crates/polymarket-client-sdks/RUSTSEC-2026-0011.md
index bf4a7249..5da327a9 100644
--- a/crates/polymarket-client-sdks/RUSTSEC-2026-0011.md
+++ b/crates/polymarket-client-sdks/RUSTSEC-2026-0011.md
@@ -5,6 +5,7 @@ package = "polymarket-client-sdks"
 date = "2026-02-13"
 expect-deleted = true
 aliases = ["GHSA-p5vf-5754-x7p3"]
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/polymarket-clients-sdk/RUSTSEC-2026-0010.md b/crates/polymarket-clients-sdk/RUSTSEC-2026-0010.md
index 93a473dc..befdc6bd 100644
--- a/crates/polymarket-clients-sdk/RUSTSEC-2026-0010.md
+++ b/crates/polymarket-clients-sdk/RUSTSEC-2026-0010.md
@@ -5,6 +5,7 @@ package = "polymarket-clients-sdk"
 date = "2026-02-06"
 expect-deleted = true
 aliases = ["GHSA-382q-fpqh-29f7"]
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/polymarkets-client-sdk/RUSTSEC-2026-0015.md b/crates/polymarkets-client-sdk/RUSTSEC-2026-0015.md
index 9279c7e8..6cf33eab 100644
--- a/crates/polymarkets-client-sdk/RUSTSEC-2026-0015.md
+++ b/crates/polymarkets-client-sdk/RUSTSEC-2026-0015.md
@@ -4,6 +4,7 @@ id = "RUSTSEC-2026-0015"
 package = "polymarkets-client-sdk"
 date = "2026-02-19"
 expect-deleted = true
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/polymarkets-rs-clob-client/RUSTSEC-2026-0016.md b/crates/polymarkets-rs-clob-client/RUSTSEC-2026-0016.md
index 4ad67bc9..7e1bb8f0 100644
--- a/crates/polymarkets-rs-clob-client/RUSTSEC-2026-0016.md
+++ b/crates/polymarkets-rs-clob-client/RUSTSEC-2026-0016.md
@@ -4,6 +4,7 @@ id = "RUSTSEC-2026-0016"
 package = "polymarkets-rs-clob-client"
 date = "2026-02-20"
 expect-deleted = true
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/rpc-check/RUSTSEC-2026-0014.md b/crates/rpc-check/RUSTSEC-2026-0014.md
index cd0946c8..2440643f 100644
--- a/crates/rpc-check/RUSTSEC-2026-0014.md
+++ b/crates/rpc-check/RUSTSEC-2026-0014.md
@@ -4,6 +4,7 @@ id = "RUSTSEC-2026-0014"
 package = "rpc-check"
 date = "2026-02-19"
 expect-deleted = true
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/rpc-check/RUSTSEC-2026-0018.md b/crates/rpc-check/RUSTSEC-2026-0018.md
index bb687901..f1e9bfe2 100644
--- a/crates/rpc-check/RUSTSEC-2026-0018.md
+++ b/crates/rpc-check/RUSTSEC-2026-0018.md
@@ -4,6 +4,7 @@ id = "RUSTSEC-2026-0018"
 package = "rpc-check"
 date = "2026-02-24"
 expect-deleted = true
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/rustdecimal/RUSTSEC-2022-0042.md b/crates/rustdecimal/RUSTSEC-2022-0042.md
index b8af7fff..93697d9a 100644
--- a/crates/rustdecimal/RUSTSEC-2022-0042.md
+++ b/crates/rustdecimal/RUSTSEC-2022-0042.md
@@ -4,7 +4,7 @@ id = "RUSTSEC-2022-0042"
 package = "rustdecimal"
 date = "2022-05-10"
 url = "https://groups.google.com/g/rustlang-security-announcements/c/5DVtC8pgJLw?pli=1"
-categories = ["code-execution"]
+categories = ["code-execution", "malicious"]
 keywords = ["typosquatting"]
 aliases = ["GHSA-7pwq-f4pq-78gm", "MAL-2022-1"]
 expect-deleted = true
diff --git a/crates/sha-rst/RUSTSEC-2025-0151.md b/crates/sha-rst/RUSTSEC-2025-0151.md
index 4c8e497c..3d692a1c 100644
--- a/crates/sha-rst/RUSTSEC-2025-0151.md
+++ b/crates/sha-rst/RUSTSEC-2025-0151.md
@@ -5,6 +5,7 @@ package = "sha-rst"
 date = "2025-12-09"
 expect-deleted = true
 aliases = ["GHSA-vgr2-r5hm-f6gf"]
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/sha-rust/RUSTSEC-2025-0146.md b/crates/sha-rust/RUSTSEC-2025-0146.md
index bf6c00e9..830cd37d 100644
--- a/crates/sha-rust/RUSTSEC-2025-0146.md
+++ b/crates/sha-rust/RUSTSEC-2025-0146.md
@@ -7,6 +7,7 @@ url = "https://blog.rust-lang.org/2025/12/05/crates.io-malicious-crates-finch-ru
 references = ["https://socket.dev/blog/malicious-crate-mimicking-finch-exfiltrates-credentials"]
 expect-deleted = true
 aliases = ["GHSA-3mmg-7c2q-8938"]
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/time-sync/RUSTSEC-2026-0036.md b/crates/time-sync/RUSTSEC-2026-0036.md
index a5710450..e2944b32 100644
--- a/crates/time-sync/RUSTSEC-2026-0036.md
+++ b/crates/time-sync/RUSTSEC-2026-0036.md
@@ -5,6 +5,7 @@ package = "time-sync"
 date = "2026-03-04"
 expect-deleted = true
 aliases = ["GHSA-mh23-rw7f-v5pq"]
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/time_calibrator/RUSTSEC-2026-0030.md b/crates/time_calibrator/RUSTSEC-2026-0030.md
index a12254dc..f8e509fc 100644
--- a/crates/time_calibrator/RUSTSEC-2026-0030.md
+++ b/crates/time_calibrator/RUSTSEC-2026-0030.md
@@ -5,6 +5,7 @@ package = "time_calibrator"
 date = "2026-03-03"
 expect-deleted = true
 aliases = ["GHSA-77xj-rrh3-wx3v"]
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/time_calibrators/RUSTSEC-2026-0031.md b/crates/time_calibrators/RUSTSEC-2026-0031.md
index 1926fecc..16c0c93c 100644
--- a/crates/time_calibrators/RUSTSEC-2026-0031.md
+++ b/crates/time_calibrators/RUSTSEC-2026-0031.md
@@ -5,6 +5,7 @@ package = "time_calibrators"
 date = "2026-03-03"
 expect-deleted = true
 aliases = ["GHSA-wf45-3gpw-vrqv"]
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/tracing-check/RUSTSEC-2026-0019.md b/crates/tracing-check/RUSTSEC-2026-0019.md
index b9f609b7..81f365bb 100644
--- a/crates/tracing-check/RUSTSEC-2026-0019.md
+++ b/crates/tracing-check/RUSTSEC-2026-0019.md
@@ -5,6 +5,7 @@ package = "tracing-check"
 date = "2026-02-24"
 expect-deleted = true
 aliases = ["GHSA-5pmp-jpcf-pwx6"]
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/tracing-ethers/RUSTSEC-2026-0040.md b/crates/tracing-ethers/RUSTSEC-2026-0040.md
index c78d0ab0..c1291edf 100644
--- a/crates/tracing-ethers/RUSTSEC-2026-0040.md
+++ b/crates/tracing-ethers/RUSTSEC-2026-0040.md
@@ -4,6 +4,7 @@ id = "RUSTSEC-2026-0040"
 package = "tracing-ethers"
 date = "2026-03-14"
 expect-deleted = true
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/tracing_checks/RUSTSEC-2026-0028.md b/crates/tracing_checks/RUSTSEC-2026-0028.md
index 00b6bd6c..d2a212dc 100644
--- a/crates/tracing_checks/RUSTSEC-2026-0028.md
+++ b/crates/tracing_checks/RUSTSEC-2026-0028.md
@@ -4,6 +4,7 @@ id = "RUSTSEC-2026-0028"
 package = "tracing_checks"
 date = "2026-02-26"
 expect-deleted = true
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/tracings/RUSTSEC-2026-0027.md b/crates/tracings/RUSTSEC-2026-0027.md
index b7cd3dfd..b541c3d6 100644
--- a/crates/tracings/RUSTSEC-2026-0027.md
+++ b/crates/tracings/RUSTSEC-2026-0027.md
@@ -4,6 +4,7 @@ id = "RUSTSEC-2026-0027"
 package = "tracings"
 date = "2026-02-26"
 expect-deleted = true
+categories = ["malicious"]
 
 [versions]
 patched = []
diff --git a/crates/uniswap-utils/RUSTSEC-2025-0145.md b/crates/uniswap-utils/RUSTSEC-2025-0145.md
index 33592c2c..6976d655 100644
--- a/crates/uniswap-utils/RUSTSEC-2025-0145.md
+++ b/crates/uniswap-utils/RUSTSEC-2025-0145.md
@@ -7,6 +7,7 @@ url = "https://blog.rust-lang.org/2025/12/03/crates.io-malicious-crates-evm-unit
 references = ["https://socket.dev/blog/malicious-rust-crate-evm-units-serves-cross-platform-payloads"]
 expect-deleted = true
 aliases = ["GHSA-x468-phr8-h3p3"]
+categories = ["malicious"]
 
 [versions]
 patched = []