RUSTSEC-2026-0472: `shinchina-test` was removed from crates.io for malicious code
Published Nov 6, 2026
·Updated
shinchina-test attempted to send telemetry from the build environment to an arbitrary URL.
The malicious crate had 1 version published on 2025-03-02, approximately 20 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io.
Thanks to Bitbison for the report.
Affected Software
1 affected component
rust/shinchina-test>=0.0.0-0
Event History
Nov 6, 2026
Advisory Published
via OSV·12:00 PM
Data Sourced
via OSV·12:00 PM
DescriptionAffected Software
Frequently Asked Questions
1
What activity did the malicious crate attempt during a build?
It attempted to send telemetry from the build environment to an arbitrary URL.
2
Is there evidence that this crate was used in real projects?
No. The available information states that there was no evidence of actual usage.
3
Did this crate pull in other crates.io dependencies?
No. It had no dependencies on crates.io.