RUSTSEC-2026-0101 `safe-agent-rs` was removed from crates.io for being affiliated with malicious code
A Rust crate was removed from crates.io due to affiliation with malicious code, posing a supply chain risk to developers who might have installed it.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is RUSTSEC-2026-0101?
RUSTSEC-2026-0101 is a vulnerability in safe-agent-rs, published on 13 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
While safe-agent-rs did not directly contain malicious code, it was owned by the same user as
pretty-changelog-logger and microsoftsystem64. safe-agent-rs also appeared to be imitating a
different websocket library. We decided to remove it out of an abundance of caution.
This crate had 2 versions published on 2026-03-24 that had a total of 4138 downloads. There were no crates depending on this crate on crates.io.
Which versions are affected by RUSTSEC-2026-0101?
1 open source package ship an affected version, including safe-agent-rs.
| Package | Affected | Fixed in |
|---|---|---|
safe-agent-rs crates.io | From 0.0.0-0 | None |
How do I fix RUSTSEC-2026-0101?
No fix has been published for RUSTSEC-2026-0101 yet. Limit exposure of the affected software until one is available.
Is RUSTSEC-2026-0101 being exploited?
There is no known exploitation of RUSTSEC-2026-0101 in the wild and no public exploit code.