`mysten-metrics` was removed from crates.io for malicious code
Affects mysten-metricsSource GCVE Database
Rated Medium by Threat Radar's AI analysis
Data as of 27 Oct 2026, 01:57 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.iomysten-metricspkg:cargo/mysten-metricsOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
The crate has been removed from crates.io, effectively mitigating the threat. Users should avoid using or depending on `mysten-metrics`. No further action is required if this crate was not used in any build environments.
Description
`mysten-metrics` was a malicious Rust crate published on crates.io that contained a build script designed to exfiltrate data from the build machine. It had only one version published on 2026-04-20 and was removed from crates.io due to this malicious behavior. There is no evidence that this crate was actually used in the wild.