GHSA-99j7-fhr2-xfj4: `exploration` was removed from crates.io for malicious code
criticalvulnerability
security
Source: GitHub Advisory DatabaseJuly 10, 2026
Summary
A malicious Rust package called `exploration` was removed from crates.io (a repository where developers share reusable code libraries) after it was discovered to contain code that downloaded and executed files from a remote server without authorization. The package was live for only about an hour before being removed, and there was no evidence that anyone actually used it.
Classification
Attack Type
Supply Chain
Attack SophisticationTrivial
Impact (CIA+S)
integrityavailability
Affected Packages
exploration@>= 0
Related Issues
Monthly digest — independent AI security research
Original source: https://github.com/advisories/GHSA-99j7-fhr2-xfj4
First tracked: July 10, 2026 at 08:01 PM
Classified by LLM (prompt v3) · confidence: 75%