PT-2025-54751 · Crates.Io · Finch-Rust

Published 2025-12-05 · Updated 2025-12-05

OSV

It depended on the sha-rust crate, which appeared to be attempting to steal credentials from local files.

Related Identifiers

RUSTSEC-2025-0148

Affected Products

Finch-Rust

References · 5

• https://osv.dev/vulnerability/RUSTSEC-2025-0148 · Vendor Advisory
• https://crates.io/crates/finch-rust · Note
• https://rustsec.org/advisories/RUSTSEC-2025-0148.html · Note
• https://socket.dev/blog/malicious-crate-mimicking-finch-exfiltrates-credentials · Note
• https://blog.rust-lang.org/2025/12/05/crates.io-malicious-crates-finch-rust-and-sha-rust · Note