Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

greentic-setup

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    greentic-setup 1.3.1-dev.34027618345 was removed from crates.io due to containing malicious code

    Affected
    • crates.io greentic-setup >= 1.3.1-dev.34027618345, < 1.3.1-dev.34027618345.0
    Fixed in
    1.3.1-dev.34027618345.0· Vendor fix available
    Issue
    A new version of the `greentic-setup` crate was published with a variant of the PolinRider malware included that would fire when a project depending on `greentic-setup` was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal. This crate is depended on by four other crates in the Greentic ecosystem, namely `greentic-start`, `greentic-start-dev`, `greentic-operator`, and `greentic-operator-dev`. We have no evidence that this crate version was downloaded by any actual users, but Greentic users should check their systems nonetheless. Thanks to the Research Team at Nextron Systems GmbH for the report.

    Recommended action: Upgrade to 1.3.1-dev.34027618345.0 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →