{
  "affected": [
    {
      "database_specific": {
        "categories": [],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "polymarkets-rs-clob-client",
        "purl": "pkg:cargo/polymarkets-rs-clob-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "This is part of an ongoing campaign to attempt to typosquat crates in the\n[`polymarket-client-sdk`](https://crates.io/crates/polymarket-client-sdk)\necosystem to exfiltrate user credentials.\n\nThe malicious crate had 1 version published on 2026-02-19 approximately 20\nhours before removal and had no evidence of actual downloads. There were no\ncrates depending on this crate on crates.io.\n\nThanks to Adam Harvey at the Rust Foundation, who is awkwardly thanking himself\nin this instance.\n\nThe crates.io team advises anyone developing with Polymarket to review\ndependencies carefully. We are investigating ways to mitigate this attacker who\nappears to be very motivated to steal Polymarket credentials.",
  "id": "RUSTSEC-2026-0016",
  "modified": "2026-02-20T18:09:09Z",
  "published": "2026-02-20T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/polymarkets-rs-clob-client"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0016.html"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "`polymarkets-rs-clob-client` was removed from crates.io for malicious code"
}