`sec-gemini` was removed from crates.io for malicious code
Affects sec-geminiSource GCVE Database
Rated Medium by Threat Radar's AI analysis
Data as of 10 Nov 2026, 13:32 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.iosec-geminipkg:cargo/sec-geminiOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
The crate has been removed from crates.io, effectively mitigating the threat. Users should avoid using or depending on `sec-gemini`. No further action is required if the crate was not used in any build environments.
Description
`sec-gemini` was a malicious Rust crate published on crates.io that attempted to send telemetry data from the build environment to an arbitrary URL. It had a single version published on 2025-06-19 and was removed approximately 17 months later. There is no evidence that this crate was actually used by others.