RUSTSEC-2026-0263 `tinymember` was removed from crates.io due to affiliation with malicious code
The tinymember crate was removed from crates.io due to its owner's association with malicious build scripts, posing a supply chain risk.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is RUSTSEC-2026-0263?
RUSTSEC-2026-0263 is a vulnerability in tinymember, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
While tinymember did not directly contain malicious code, it was owned by the
same user as arone and aronenao, which contained suspicious build scripts.
This crate had 2 versions published on 2026-08-18 that had a total of 27 downloads. There were no crates depending on this crate on crates.io. The crate was removed from crates.io and the user account was locked.
Which versions are affected by RUSTSEC-2026-0263?
1 open source package ship an affected version, including tinymember.
| Package | Affected | Fixed in |
|---|---|---|
tinymember crates.io | From 0.0.0-0 | None |
How do I fix RUSTSEC-2026-0263?
No fix has been published for RUSTSEC-2026-0263 yet. Limit exposure of the affected software until one is available.
Is RUSTSEC-2026-0263 being exploited?
There is no known exploitation of RUSTSEC-2026-0263 in the wild and no public exploit code.