Open-source package vulnerability · Rust (crates.io)

GHSA-qprh-m6p3-hwxc: `sui-execution-cut` was removed from crates.io for malicious code

critical

sui-execution-cut included a build script that attempted to exfiltrate data from the build machine. The malicious crate had 1 version published on 2026-04-20 and had no evidence of actual usage. This crate had no dependencies on crates.io.

Published May 4, 2026

Affected packages

sui-execution-cut

Ecosystem: Rust (crates.io)
Affected: >= 0
Fixed in: No patched version yet
Check: cargo tree -i sui-execution-cut

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

sui-execution-cut included a build script that attempted to exfiltrate data from the build machine.

The malicious crate had 1 version published on 2026-04-20 and had no evidence of actual usage. This crate had no dependencies on crates.io.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology