Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 6 November 2026.

Which products and versions are affected?

sec-gemini (crates.io) 0.0.0, SEMVER:introduced=0.0.0-0.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run sec-gemini (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

sec-gemini malicious code in Rust crate

Severity: info · Published 2026-11-06

A Rust library package called sec-gemini was removed from the official crates.io repository after being discovered to contain malicious code. The malicious package attempted to exfiltrate build environment data to an attacker-controlled server during compilation. Although the package was published for 17 months before removal, there was no evidence of actual adoption or usage.

Vendors: crates.io.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 6 November 2026.
Which products and versions are affected?: sec-gemini (crates.io) 0.0.0, SEMVER:introduced=0.0.0-0.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run sec-gemini (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The sec-gemini crate contained code that attempted to send telemetry data from the build environment to an arbitrary URL during the build process. This is a supply chain attack vector targeting Rust developers who would have included the package as a dependency. The malicious behavior would execute during compilation, potentially exfiltrating environment variables, credentials, or other sensitive build-time information.

Affected products

crates.io sec-gemini 0.0.0

Timeline

2025-06-19: other: Malicious version published to crates.io
2026-11-06: disclosed
2026-11-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.