Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0263

`tinymember` was removed from crates.io due to affiliation with malicious code

Published Aug 20, 2026 · Updated Aug 20, 2026 · Assigned by RUSTSEC

Description

While `tinymember` did not directly contain malicious code, it was owned by the
same user as `arone` and `aronenao`, which contained suspicious build scripts.

This crate had 2 versions published on 2026-08-18 that had a total of 27 downloads.
There were no crates depending on this crate on crates.io. The crate was removed
from crates.io and the user account was locked.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io tinymember >= 0.0.0-0 — RUSTSEC-2026-0263

References