RUSTSEC-2023-0124

    Dashboard / Vulnerabilities / RUSTSEC-2023-0124

    RUSTSEC-2023-0124

    Published: 22 Dec 2023Last Modified: 26 Mar 2026

    Summary: `bit-flags` was removed from crates.io for malicious code

    Details: This crate was part of a typosquatting malware cluster published by the user `alexrichton` to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available. The related malicious crates have been yanked, and the malicious account has been banned.

    References: https://crates.io/crates/bit-flags, https://rustsec.org/advisories/RUSTSEC-2023-0124.html

    Affected packages

    Package

    Name: bit-flags

    Purl: pkg:cargo/bit-flags

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.0.0-0
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    RUSTSEC-2023-0124 | CVE-DB