RUSTSEC-2026-0464: `webhook_commands` was removed from crates.io for malicious code
Published Nov 9, 2026
·Updated
webhookcommands attempted to send telemetry from the execution environment to an arbitrary URL.
The malicious crate had 1 version published on 2026-02-13, approximately 9 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io.
Thanks to Bitbison for the report.
Affected Software
1 affected component
rust/webhook_commands>=0.0.0-0
Event History
Nov 9, 2026
Advisory Published
via OSV·12:00 PM
Data Sourced
via OSV·12:00 PM
DescriptionAffected Software
Frequently Asked Questions
1
How many releases need to be investigated?
The crate had a single published version, released on 2026-02-13.
2
Is there evidence that this crate was used in the wild?
No evidence of actual usage was identified in the available data. This does not establish whether a specific environment downloaded or executed it.
3
Does the crate bring in additional crates.io dependencies that also need review?
No. The crate had no dependencies on crates.io.