RUSTSEC-2026-0014 json
`rpc-check` was removed from crates.io for malicious code
published 8mo ago modified 7mo ago
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
It was attempting to steal credentials from the `POLYMARKET_PRIVATE_KEY` environment variable.
The malicious crate had 3 versions published on 2026-02-15 and had been downloaded only 155 times. There were no crates depending on this crate on crates.io.
Thanks to Sisong Li for finding and reporting this to the crates.io team!
Is RUSTSEC-2026-0014 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | rpc-check | >=0.0.0-0 |
no fix listed |
References
Sources
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.