RUSTSEC-2026-0470: `gabby-types-sec` was removed from crates.io for malicious code

Published Nov 9, 2026

Updated

gabby-types-sec attempted to send telemetry from the build environment to an arbitrary URL.

The malicious crate had 1 version published on 2026-02-17, approximately 9 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io.

Thanks to Bitbison for the report.

Affected Software

1 affected component

rust/gabby-types-sec>=0.0.0-0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove gabby-types-sec from your environment.
Uninstall or remove the malicious crate gabby-types-sec.

Event History

Nov 9, 2026

Advisory Published

via OSV·12:00 PM

Data Sourced

via OSV·12:00 PM

DescriptionAffected Software

Frequently Asked Questions

What would an attacker need to exploit this package?

A build environment would need to include the malicious crate. Its code attempted to send telemetry from that build environment to an arbitrary URL.

How likely is existing exposure?

The advisory reports no evidence of actual usage. The crate had one published version and no dependencies on crates.io, which limits known transitive exposure through other crates.

How can I check whether we were affected?

Review dependency manifests and lockfiles for gabby-types-sec, and review build records for projects that may have resolved it. The package was published on 2026-02-17 and remained available for approximately nine months before removal.

RUSTSEC-2026-0470: `gabby-types-sec` was removed from crates.io for malicious code

Affected Software

Remediation

Event History

Frequently Asked Questions

What would an attacker need to exploit this package?

How likely is existing exposure?

How can I check whether we were affected?

Company

Resources

Contact

Frequently Asked Questions

What would an attacker need to exploit this package?

How likely is existing exposure?

How can I check whether we were affected?