RUSTSEC-2026-0040 `tracing-ethers` was removed from crates.io due to malicious code
A malicious Rust crate exfiltrated SSH keys to a remote server, requiring developers to avoid using the removed package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is RUSTSEC-2026-0040?
RUSTSEC-2026-0040 is a vulnerability in tracing-ethers, published on 14 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The tracing-ethers crate attempted to exfiltrate ssh keys to an app hosted on vercel.app
The malicious crate had 9 version published on 2026-03-09 approximately 5 days before removal and had no evidence of actual downloads. There were no crates depending on this crate on crates.io.
Thanks to the user killa for reporting this malicious crate.
Which versions are affected by RUSTSEC-2026-0040?
1 open source package ship an affected version, including tracing-ethers.
| Package | Affected | Fixed in |
|---|---|---|
tracing-ethers crates.io | From 0.0.0-0 | None |
How do I fix RUSTSEC-2026-0040?
No fix has been published for RUSTSEC-2026-0040 yet. Limit exposure of the affected software until one is available.
Is RUSTSEC-2026-0040 being exploited?
There is no known exploitation of RUSTSEC-2026-0040 in the wild and no public exploit code.