GHSA-99j7-fhr2-xfj4: `exploration` was removed from crates.io for malicious code
A method within the exploration crate attempted to download and execute a payload from a remote site. The malicious crate had 1 version published on 2026-06-02, approximately 1 hour before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Rustsec to Kirill Boychenko from the Socket Threat Research Team for reporting this crate.
Published Jul 10, 2026
Affected packages
exploration
- Ecosystem
- Rust (crates.io)
- Affected
- >= 0
- Fixed in
- No patched version yet
- Check
cargo tree -i exploration
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A method within the exploration crate attempted to download and execute a payload from a remote site.
The malicious crate had 1 version published on 2026-06-02, approximately 1 hour before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io.
Rustsec to Kirill Boychenko from the Socket Threat Research Team for reporting this crate.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology