Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 5 November 2026.

Which products and versions are affected?

ocipkg (crates.io) SEMVER:introduced=0.0.0-0; Termoshtt Ocipkg all versions up to and including 0.4.1.

Check whether you run ocipkg (crates.io) or Termoshtt Ocipkg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

ocipkg library unmaintained

Severity: info · Published 2026-11-05

The ocipkg Rust library, which manages packages via OCI (Open Container Initiative) registries, is no longer maintained by its author. The final release is version 0.4.1, and no further updates or security fixes are planned. Users of this library should transition to an alternative such as ORAS' oci-client or maintain their own fork.

Vendors: crates.io.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 5 November 2026.
Which products and versions are affected?: ocipkg (crates.io) SEMVER:introduced=0.0.0-0; Termoshtt Ocipkg all versions up to and including 0.4.1.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Migrate to the ORAS project's oci-client for OCI registry interaction, or fork version 0.4.1 of ocipkg and maintain it internally for ocipkg-specific features (local package management, build-time library fetching and linking). If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is in a software library.
Am I affected?: Check whether you run ocipkg (crates.io) or Termoshtt Ocipkg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Migrate to the ORAS project's oci-client for OCI registry interaction, or fork version 0.4.1 of ocipkg and maintain it internally for ocipkg-specific features (local package management, build-time library fetching and linking).

Technical details

The ocipkg crate for OCI registry interaction and package management has been officially archived with no future maintenance. While no active vulnerabilities are disclosed, the lack of security updates poses a risk for long-term use, especially if vulnerabilities are discovered in dependencies or in ocipkg itself. Users requiring OCI registry functionality should migrate to maintained alternatives or establish their own maintenance fork from version 0.4.1.

Affected products

termoshtt ocipkg all versions up to and including 0.4.1

Timeline

2026-11-05: advisory: Maintainer declared crate unmaintained; version 0.4.1 stated as final release
2026-11-06: other: Advisory issued

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.