`build_dep` was removed from crates.io for malicious code
Affects build_depSource GCVE Database
0
Severity
MediumRated Medium by Threat Radar's AI analysis
Data as of 10 Nov 2026, 13:33 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.iobuild_deppkg:cargo/build_depOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
The crate was removed from crates.io, effectively mitigating the threat. Users should ensure they do not use or depend on the `build_dep` crate. No further action is required if this crate was not used.
Description
`build_dep` was a malicious crate on crates.io that attempted to send telemetry data from the build environment to an arbitrary URL. It had a single version published on 2025-03-03 and was removed approximately 20 months later. There is no evidence that it was actually used or had dependencies on crates.io.
References
Community reviews
Loading reviews…