RUSTSEC-2026-0468: `shinchina` was removed from crates.io for malicious code

shinchina attempted to send telemetry from the build environment to an arbitrary URL.

The malicious crate had 1 version published on 2025-03-01, approximately 20 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io.

Thanks to Bitbison for the report.