Description
`sec-gemini` attempted to send telemetry from the build environment to an
arbitrary URL.
The malicious crate had 1 versions published on 2025-06-19, approximately 17
months before removal, and had no evidence of actual usage. This crate had no
dependencies on crates.io.
Thanks to [Bitbison](https://bitbison.io/) for the report.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | sec-gemini | >= 0.0.0-0 | — | RUSTSEC-2026-0471 |