GCVE-110-OSM-2026-8464

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published July 18, 2026

`winx-rs` was removed from crates.io for malicious code Details: This crate was part of a typosquatting malware cluster published by the user `Kraded` to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available. The related malicious crates have been yanked, and the malicious account has been banned.

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	winx-rs	all (affected)	—

References

Malicious crates package: winx-rs

advisory

vendor

Browse GCVE Records

75,788 records in the GCVE database · Updated August 2, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON