lsh

{"modified":"2026-04-28T14:20:08Z","published":"2026-04-28T01:45:56Z","schema_version":"1.7.4","id":"MAL-2026-3126","summary":"Malicious code in lsh (crates.io)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (8cd6cecd3051e3998c5f96ec8dbe1bcfffc1ed7133d394a1779c8c1b0252c8c0)\nThe OpenSSF Package Analysis project identified 'lsh' @ 99.0.1 (crates.io) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"ecosystem":"crates.io","name":"lsh"},"versions":["99.0.1","99.1.0"]}],"credits":[{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]}],"database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","sha256":"8cd6cecd3051e3998c5f96ec8dbe1bcfffc1ed7133d394a1779c8c1b0252c8c0","import_time":"2026-04-28T06:04:30.698576513Z","modified_time":"2026-04-28T01:45:56Z","versions":["99.0.1"]},{"source":"ossf-package-analysis","sha256":"0d659fd33aac3eba6d4a9616642cd843d8cb7ae8a7433d94cad9dade68235d9e","import_time":"2026-04-28T14:18:17.125757194Z","modified_time":"2026-04-28T13:41:20Z","versions":["99.1.0"]}]}}