RUSTSEC-2026-0280
Vulnerability from osv_rustsec
Published
2026-09-07 12:00
Modified
2026-09-07 18:19
Summary
`greentic-setup-dev` 1.3.34027618345 was removed from crates.io due to containing malicious code
Details

A new version of the greentic-setup-dev crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup-dev was opened in Visual Studio Code.

One malicious version was published on 2026-09-06, approximately 27 hours before removal. This crate has no dependencies on crates.io. We have no evidence that this crate version was downloaded by any actual users, but Greentic users should check their systems nonetheless.

Thanks to the Research Team at Nextron Systems GmbH for the report.

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "malicious"
        ],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "greentic-setup-dev",
        "purl": "pkg:cargo/greentic-setup-dev"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.3.34027618345"
            },
            {
              "fixed": "1.3.34027618346-0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "A new version of the `greentic-setup-dev` crate was published with a variant of\nthe PolinRider malware included that would fire when a project depending on\n`greentic-setup-dev` was opened in Visual Studio Code.\n\nOne malicious version was published on 2026-09-06, approximately 27 hours\nbefore removal. This crate has no dependencies on crates.io. We have no\nevidence that this crate version was downloaded by any actual users, but\nGreentic users should check their systems nonetheless.\n\nThanks to the Research Team at Nextron Systems GmbH for the report.",
  "id": "RUSTSEC-2026-0280",
  "modified": "2026-09-07T18:19:30Z",
  "published": "2026-09-07T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/greentic-setup-dev"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0280.html"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "`greentic-setup-dev` 1.3.34027618345 was removed from crates.io due to containing malicious code"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.