Skip to main content
VulnerabilityPublished Updated

`top_level_crate` was removed from crates.io for malicious code

Affects top_level_crateSource GCVE Database

0
Severity
Medium

Rated Medium by Threat Radar's AI analysis

Data as of 10 Nov 2026, 13:33 UTC

What to do

Affected software

ProductAffectedFixed in
crates.iotop_level_cratepkg:cargo/top_level_crateOther threatsAffected
  • >=0.0.0-0
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

The malicious crate has been removed from crates.io. Users should ensure they do not depend on `top_level_crate` in their projects.

Description

`top_level_crate` was a malicious Rust crate on crates.io that attempted to send telemetry data from the build environment to an arbitrary URL. It had only one version published on 2025-03-01 and was removed approximately 20 months later. There is no evidence that this crate was actually used in the wild, and it had no dependencies on crates.io.

References

Community reviews

Loading reviews…