RUSTSEC-2026-0469: `env-test-guard` was removed from crates.io for malicious code
env-test-guard attempted to exfiltrate credentials from the environment to an arbitrary URL.
The malicious crate had 2 versions published on 2026-03-24 and 2026-03-25, approximately 8 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io.
Thanks to Bitbison for the report.
Affected Software
Event History
Frequently Asked Questions
Who is at risk from this crate?
Projects that added either of the two published versions of env-test-guard are potentially exposed, particularly if the crate ran in an environment containing credentials. The advisory reports no evidence of actual usage.
What could the malicious code do?
It attempted to send credentials obtained from environment variables to an arbitrary URL. This could expose secrets available to the process, such as CI credentials or other environment-provided tokens.
How can I determine whether my project was affected?
Check Cargo.toml and Cargo.lock files, including those for development and test tooling, for env-test-guard. Also review build and CI dependency records from the period when the crate's two versions were available.
What should I do if the crate was present?
Remove env-test-guard and rotate credentials that may have been available in environment variables while it was executed. Review relevant CI and application logs for unexpected outbound requests, where such logs are available.