VulnerabilityPublished
`mysten-metrics` was removed from crates.io for malicious code
Affects mysten-metricsSource GCVE Database
0
Severity
CriticalRated by Threat Radar
Data as of 27 Oct 2026, 00:07 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| crates.iomysten-metrics | Affected– | Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
`mysten-metrics` included a build script that attempted to exfiltrate data from the build machine. The malicious crate had 1 version published on 2026-04-20 and had no evidence of actual usage. This crate had no dependencies on crates.io.
References
Community reviews
Loading reviews…