RUSTSEC-2026-0175None▾ Sunlit`onering` 1.4.1 was removed from crates.io for malicious code
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
A new version of the onering crate was published with code that attempted to
exfiltrate both metadata and code from the project it was included within.
One malicious version was published on 2026-06-10, approximately six hours before removal. This crate has no dependencies on crates.io, and there is no evidence of actual usage of the compromised version.
Thanks to Charlie Eriksen for the report.
onering >= 1.4.1, < 1.4.2-0Upgrade to a patched release:
onering 1.4.2-0