Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0471

`sec-gemini` was removed from crates.io for malicious code

Published Nov 6, 2026 · Updated Nov 10, 2026 · Assigned by RUSTSEC

Description

`sec-gemini` attempted to send telemetry from the build environment to an
arbitrary URL.

The malicious crate had 1 versions published on 2025-06-19, approximately 17
months before removal, and had no evidence of actual usage. This crate had no
dependencies on crates.io.

Thanks to [Bitbison](https://bitbison.io/) for the report.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io sec-gemini >= 0.0.0-0 — RUSTSEC-2026-0471

References