Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0465

`electrumd` was removed from crates.io for malicious code

Published Nov 9, 2026 · Updated Nov 10, 2026 · Assigned by RUSTSEC

Description

`electrumd` attempted to send telemetry from the build environment to an
arbitrary URL.

The malicious crate had 5 versions published on 2026-01-26, approximately 10
months before removal, and had no evidence of actual usage. This crate had no
dependencies on crates.io.

Thanks to [Bitbison](https://bitbison.io/) for the report.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io electrumd >= 0.0.0-0 — RUSTSEC-2026-0465

References