---
id: RUSTSEC-2026-0175
title: '`onering` 1.4.1 was removed from crates.io for malicious code'
summary: '`onering` 1.4.1 was removed from crates.io for malicious code'
severity: none
vendor: onering
product: onering
ecosystem: rust
affected:
  - 'onering >= 1.4.1, < 1.4.2-0'
patched:
  - onering 1.4.2-0
published: '2026-06-10'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T15:16:11Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0175'
references:
  - url: 'https://crates.io/crates/onering'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0175.html'
tags:
  - osv
  - rust
ingestedAt: '2026-09-24T07:16:01.870Z'
---

## Overview

A new version of the `onering` crate was published with code that attempted to
exfiltrate both metadata and code from the project it was included within.

One malicious version was published on 2026-06-10, approximately six hours
before removal. This crate has no dependencies on crates.io, and there is no
evidence of actual usage of the compromised version.

Thanks to Charlie Eriksen for the report.

## Affected packages

- `onering >= 1.4.1, < 1.4.2-0`

## Remediation

Upgrade to a patched release:

- `onering 1.4.2-0`