Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0040

`tracing-ethers` was removed from crates.io due to malicious code

Published Mar 14, 2026 · Updated Mar 17, 2026 · Assigned by RUSTSEC

Description

The `tracing-ethers` crate attempted to exfiltrate ssh keys to an app hosted on `vercel.app`

The malicious crate had 9 version published on 2026-03-09 approximately 5 days
before removal and had no evidence of actual downloads. There were no crates
depending on this crate on crates.io.

Thanks to the user `killa` for reporting this malicious crate.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io tracing-ethers >= 0.0.0-0 — RUSTSEC-2026-0040

References