Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0467

`top_level_crate` was removed from crates.io for malicious code

Published Nov 6, 2026 · Updated Nov 10, 2026 · Assigned by RUSTSEC

Description

`top_level_crate` attempted to send telemetry from the build environment to an
arbitrary URL.

The malicious crate had 1 version published on 2025-03-01, approximately 20
months before removal, and had no evidence of actual usage. This crate had no
dependencies on crates.io.

Thanks to [Bitbison](https://bitbison.io/) for the report.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io top_level_crate >= 0.0.0-0 — RUSTSEC-2026-0467

References