{"id":"GHSA-99j7-fhr2-xfj4","aliases":["RUSTSEC-2026-0155"],"url":"https://o3.security/vulnerability/GHSA-99j7-fhr2-xfj4","summary":"`exploration` was removed from crates.io for malicious code","details":"A method within the `exploration` crate attempted to download and execute a payload from a remote site.\n\nThe malicious crate had 1 version published on 2026-06-02, approximately 1 hour before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io.\n\nRustsec to Kirill Boychenko from the [Socket Threat Research Team](https://socket.dev/) for reporting this crate.","published":"2026-07-10T19:32:24Z","modified":"2026-07-11T06:26:40.907706714Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"exploration","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0155.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-11T06:26:40.907706714Z"}}