GCVE-110-OSM-2026-8449

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published July 18, 2026

`rpc-check` was removed from crates.io for malicious code Details: It was attempting to steal credentials from the `POLYMARKET_PRIVATE_KEY` environment variable. The malicious crate had 3 versions published on 2026-02-15 and had been downloaded only 155 times. There were no crates depending on this crate on crates.io. Thanks to Sisong Li for finding and reporting this to the crates.io team!

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	rpc-check	all (affected)	—

References

Malicious crates package: rpc-check

advisory

vendor

Browse GCVE Records

75,797 records in the GCVE database · Updated August 3, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON