VulnerabilityPublished 9 Nov 2026Updated 10 Nov 2026

`env-test-guard` was removed from crates.io for malicious code

Affects env-test-guardSource GCVE Database

Severity

High

Rated High by Threat Radar's AI analysis

Data as of 10 Nov 2026, 13:33 UTC

What to do

Affected software

Product	Affected	Fixed in
crates.ioenv-test-guard`pkg:cargo/env-test-guard`Other threats	Affected >=0.0.0-0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

The crate has been removed from crates.io, preventing further downloads. Users should ensure they do not use or depend on `env-test-guard`.

Description

`env-test-guard` was a malicious Rust crate published on crates.io that attempted to exfiltrate environment credentials to an arbitrary URL. It had two versions published in March 2026 and was removed approximately eight months later. There is no evidence that it was actually used in the wild.

Impact

If used, this crate could exfiltrate sensitive environment credentials to an arbitrary URL, potentially compromising security. However, there is no evidence of actual exploitation or usage in the wild.

Summary

`env-test-guard` is a malicious crate published on crates.io that contained code designed to steal credentials from the environment and send them to an attacker-controlled URL. The crate had two published versions on 2026-03-24 and 2026-03-25. It had no dependencies and no confirmed usage. The crate was removed from crates.io about eight months after publication following a report by Bitbison.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Nov 2026, 13:33 UTC

Technical details

References

Community reviews