N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-6v2j-vr4h-f632

GHSA-6v2j-vr4h-f632: `finch_cli_rust` was removed from crates.io for malicious code

This attempts to typosquat the existing crate finch_cli to steal credentials from local files.

The malicious crate had 1 version published on 2025-12-08 and had been downloaded 18 times. There were no crates depending on this crate on crates.io.

Thanks to Matthias Zepper of NGI Sweden for reporting this to the crates.io team!

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-6v2j-vr4h-f632

GHSA-6v2j-vr4h-f632:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
finch_cli_rust	rust	>= 0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is due to a malicious crate, finch_cli_rust, which was designed to steal local credentials. Since the crate was removed and no source code is available, this analysis is based on the description of the crate's behavior. The malicious actions, reading files and sending data over the network, would be initiated when the program is run. In a Rust application, the main function is the entry point of the program. Therefore, it is the most probable location for the malicious code. Any user running this typosquatted CLI tool would trigger the execution of the main function, which in turn would perform the credential theft. A runtime profiler would show the main function as the top-level function in the call stack during the malicious operation.

Vulnerable functions

main

src/main.rs

The crate is described as malicious and designed to steal credentials from local files. In a Rust command-line application, the `main` function is the entry point for execution. It is the most logical place to contain the malicious code that reads local files and exfiltrates credentials. When the malicious CLI is run, the `main` function would be the first function in the call stack to execute the malicious payload.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.