Open-source package vulnerability · Rust (crates.io)

GHSA-g38r-8gmr-ghrf: `mysten-metrics` was removed from crates.io for malicious code

critical

mysten-metrics included a build script that attempted to exfiltrate data from the build machine. The malicious crate had 1 version published on 2026-04-20 and had no evidence of actual usage. This crate had no dependencies on crates.io.

Published May 4, 2026

Affected packages

mysten-metrics

Ecosystem: Rust (crates.io)
Affected: >= 0
Fixed in: No patched version yet
Check: cargo tree -i mysten-metrics

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

mysten-metrics included a build script that attempted to exfiltrate data from the build machine.

The malicious crate had 1 version published on 2026-04-20 and had no evidence of actual usage. This crate had no dependencies on crates.io.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology