Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 9 November 2026.

Which products and versions are affected?

webhook_commands (crates.io) SEMVER:introduced=0.0.0-0; Webhook Commands 0.0.0-0 and earlier.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run webhook_commands (crates.io) or Webhook Commands at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

webhook_commands malicious code in Rust crate

Severity: info · Published 2026-11-09

The webhook_commands Rust library was removed from crates.io after being found to contain malicious code that attempted to exfiltrate telemetry data from the execution environment to an attacker-controlled URL. While the crate had minimal adoption with no observed real-world usage, any application that included this dependency could have had sensitive execution environment data exposed. The malicious crate remained available for approximately 9 months before detection and removal.

Vendors: crates.io.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 9 November 2026.
Which products and versions are affected?: webhook_commands (crates.io) SEMVER:introduced=0.0.0-0; Webhook Commands 0.0.0-0 and earlier.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Remove the webhook_commands crate from all project dependencies and audit builds and runtime environments for any compromise indicators. Verify no builds were created or distributed that included this malicious dependency. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run webhook_commands (crates.io) or Webhook Commands at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Remove the webhook_commands crate from all project dependencies and audit builds and runtime environments for any compromise indicators. Verify no builds were created or distributed that included this malicious dependency.

Technical details

The webhook_commands crate (version 0.0.0-0 and earlier) contained code designed to collect and send telemetry from the local execution environment to an arbitrary remote URL. The attack requires inclusion of the crate as a dependency in a Rust project and subsequent compilation; no authentication or special privileges are required. There is no patched version; the crate was removed from the registry entirely.

Affected products

webhook_commands 0.0.0-0 and earlier

Timeline

2026-02-13: other: Malicious crate version published to crates.io
2026-11-09: disclosed: Vulnerability reported and crate removed from crates.io
2026-11-10: advisory: RUSTSEC-2026-0464 advisory issued

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.