crates.io tinymember vulnerabilities

Latest crates.io tinymember CVEs

Newest publication first

1. RUSTSEC-2026-0263 `tinymember` was removed from crates.io due to affiliation with malicious code

   Published 2026-08-20

   Unknown

   While tinymember did not directly contain malicious code, it was owned by the same user as arone and aronenao, which contained suspicious build scripts. This crate had 2 versions published on 2026-08-18 that had a total of 27 downloads. There were no crates depending on this crat...

2. MAL-2026-14340 Malicious code in tinymember (crates.io)

   Published 2026-08-20

   Unknown

   tinymember is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled depe...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.