`mysten-metrics` was a malicious crate published on crates.io that included a build script designed to exfiltrate data from the build machine. It had only one version published on 2026-04-20 and was removed from crates.io after discovery. There is no evidence that this crate was actually used or depended upon by other packages.