`env-test-guard` was a malicious Rust crate published on crates.io that attempted to exfiltrate environment credentials to an arbitrary URL. It had two versions published in March 2026 and was removed approximately eight months later. There is no evidence that it was actually used in the wild.