RUSTSEC-2023-0098

    Dashboard / Vulnerabilities / RUSTSEC-2023-0098

    RUSTSEC-2023-0098

    Published: 16 Aug 2023Last Modified: 19 Mar 2026

    Summary: `if-cfg` was removed from crates.io for malicious code

    Details: This crate was part of a typosquatting malware cluster published by the malicious user `amaperf` and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available. The related malicious crates have been yanked, and the malicious account has been banned. Thanks to [Veracode](https://www.veracode.com/) (formerly phylum)for reporting this to the crates.io team!

    References: https://crates.io/crates/if-cfg, https://rustsec.org/advisories/RUSTSEC-2023-0098.html, https://www.veracode.com/blog/rust-malware-staged-on-crates-io/

    Affected packages

    Package

    Name: if-cfg

    Purl: pkg:cargo/if-cfg

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.0.0-0
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    RUSTSEC-2023-0098 | CVE-DB