crates.io finch_cli_rust vulnerabilities

Latest crates.io finch_cli_rust CVEs

Newest publication first

1. GHSA-6v2j-vr4h-f632 `finch_cli_rust` was removed from crates.io for malicious code

   Published 2026-02-12

   Unknown

   This attempts to typosquat the existing crate finch_cli to steal credentials from local files. The malicious crate had 1 version published on 2025-12-08 and had been downloaded 18 times. There were no crates depending on this crate on crates.io. Thanks to Matthias Zepper of NGI S...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.