Skip to content
OpenAdvisories
Unscored RUSTSEC-2025-0157

`statsrelay-protobuf` was removed from crates.io for malicious code

Published Aug 26, 2025 · Updated Mar 30, 2026 · Assigned by RUSTSEC

Description

`statsrelay-protobuf` was part of a campaign that attempted to exfiltrate
environmental data from the host.

The malicious crate had 1 version published in August 2025, and had no evidence
of actual usage. This crate had no dependencies on crates.io.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io statsrelay-protobuf >= 0.0.0-0 — RUSTSEC-2025-0157

References