Skip to content
OpenAdvisories
Unscored RUSTSEC-2025-0160

`custom-req-on-workers` was removed from crates.io for malicious code

Published Jan 30, 2025 · Updated Mar 30, 2026 · Assigned by RUSTSEC

Description

`custom-req-on-workers` was part of a campaign that attempted to exfiltrate
environmental data from the host.

The malicious crate had 1 version published in January 2025, and had no
evidence of actual usage. This crate had no dependencies on crates.io.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io custom-req-on-workers >= 0.0.0-0 — RUSTSEC-2025-0160

References