RUSTSEC-2026-0465: `electrumd` was removed from crates.io for malicious code

Published Nov 9, 2026

Updated

electrumd attempted to send telemetry from the build environment to an arbitrary URL.

The malicious crate had 5 versions published on 2026-01-26, approximately 10 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io.

Thanks to Bitbison for the report.

Affected Software

1 affected component

rust/electrumd>=0.0.0-0

Event History

Nov 9, 2026

Advisory Published

via OSV·12:00 PM

Data Sourced

via OSV·12:00 PM

DescriptionAffected Software

Frequently Asked Questions

When would a build environment have been exposed?

Exposure would require building one of the five published versions while it was available. The crate attempted to send telemetry from the build environment to an arbitrary URL.

Is there evidence that the malicious crate was used in practice?

No. The advisory states that there was no evidence of actual usage.

What should teams check in their Rust projects?

Review project manifests, lockfiles, and build records for use of electrumd, particularly versions obtained after its 2026-01-26 publication. The crate was removed from crates.io.

RUSTSEC-2026-0465: `electrumd` was removed from crates.io for malicious code

Affected Software

Event History

Frequently Asked Questions

When would a build environment have been exposed?

Is there evidence that the malicious crate was used in practice?

What should teams check in their Rust projects?

Company

Resources

Contact

Frequently Asked Questions

When would a build environment have been exposed?

Is there evidence that the malicious crate was used in practice?

What should teams check in their Rust projects?