RUSTSEC-2026-0467: `top_level_crate` was removed from crates.io for malicious code

Published Nov 6, 2026

Updated

toplevelcrate attempted to send telemetry from the build environment to an arbitrary URL.

The malicious crate had 1 version published on 2025-03-01, approximately 20 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io.

Thanks to Bitbison for the report.

Affected Software

1 affected component

rust/top_level_crate>=0.0.0-0

Event History

Nov 6, 2026

Advisory Published

via OSV·12:00 PM

Data Sourced

via OSV·12:00 PM

DescriptionAffected Software

Frequently Asked Questions

What environments are exposed to the telemetry attempt?

The crate attempted to send telemetry from the build environment, so exposure would occur where the crate is built.

Was this crate likely present through transitive dependencies?

No. The crate had no dependencies on crates.io, so it would not have been pulled in through a crates.io dependency chain.

Is there evidence that the malicious version was used?

No evidence of actual usage was identified.

What should teams check in their projects?

Check dependency manifests and lockfiles for top_level_crate, and review build environments that built projects containing it for attempted outbound telemetry.

RUSTSEC-2026-0467: `top_level_crate` was removed from crates.io for malicious code

Affected Software

Event History

Frequently Asked Questions

What environments are exposed to the telemetry attempt?

Was this crate likely present through transitive dependencies?

Is there evidence that the malicious version was used?

What should teams check in their projects?

Company

Resources

Contact

Frequently Asked Questions

What environments are exposed to the telemetry attempt?

Was this crate likely present through transitive dependencies?

Is there evidence that the malicious version was used?

What should teams check in their projects?