RUSTSEC-2026-0015 json
`polymarkets-client-sdk` was removed from crates.io for malicious code
published 8mo ago modified 7mo ago
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
It appeared to be typosquatting existing crate [`polymarket-client-sdk`](https://crates.io/crates/polymarket-client-sdk) (`polymarkets` vs `polymarket`) and attempting to steal credentials from local files.
The malicious crate had 1 version published on 2026-02-19 an hour before removal and hadn't been downloaded. There were no crates depending on this crate on crates.io.
Thanks to Carol Nichols, who is thanking herself for spotting this in the docs.rs build queue and removing it quickly!
The crates.io team advises anyone developing with Polymarket to review dependencies carefully. We are investigating ways to mitigate this attacker who appears to be very motivated to steal Polymarket credentials.
Is RUSTSEC-2026-0015 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | polymarkets-client-sdk | >=0.0.0-0 |
no fix listed |
References
Sources
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.