GCVE-110-OSM-2026-8437

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published July 18, 2026

`tracing-ethers` was removed from crates.io due to malicious code Details: The `tracing-ethers` crate attempted to exfiltrate ssh keys to an app hosted on `vercel.app` The malicious crate had 9 version published on 2026-03-09 approximately 5 days before removal and had no evidence of actual downloads. There were no crates depending on this crate on crates.io. Thanks to the user `killa` for reporting this malicious crate.

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	tracing-ethers	all (affected)	—

References

Malicious crates package: tracing-ethers

advisory

vendor

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON