Skip to content
OpenAdvisories

Package · crates.io

tree-sitter-pkl

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Unscored —
    RUSTSEC-2025-0156

    `tree-sitter-pkl` was removed from crates.io for malicious code

    `tree-sitter-pkl` was part of a campaign that attempted to exfiltrate environmental data from the host. The malicious crate had 1 version published in March 2025, and had no evidence of actual usage. This crate had no dependencies on crates.io.

    tree-sitter-pkl crates.io