Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Malware Found in `pretty-changelog-logger` on Crates.io
published 6 months ago
Summary
The `pretty-changelog-logger` crate on crates.io contained code that could install malware on users' systems. This has been removed, but users who downloaded the affected versions may need to take precautions to ensure their systems are secure. If you downloaded this crate, check your system for any signs of suspicious activity and consider running a full system scan to be safe.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| crates.io | – | pretty-changelog-logger | >= 0.0.0-0 |
Original advisory text
`pretty-changelog-logger` was removed from crates.io for malicious code
`pretty-changelog-logger` contains a build script (build.rs) that acts as a loader/dropper for malicious payloads.
The malicious crate had 3 versions published on 2026-04-08 that had a total of 2239 downloads. There were no crates depending on this crate on crates.io.
Thanks to [Socket.dev](https://socket.dev/) for detecting and reporting this to the crates.io team!
The malicious crate had 3 versions published on 2026-04-08 that had a total of 2239 downloads. There were no crates depending on this crate on crates.io.
Thanks to [Socket.dev](https://socket.dev/) for detecting and reporting this to the crates.io team!
References
Timeline
Published13 Apr 2026
Updated15 Apr 2026
First seen15 Apr 2026
Sources
RUSTSEC-2026-0100 · OSV
Track software like this
Free during beta