`finch-rust` was removed from crates.io for malicious code
It depended on the sha-rust crate, which appeared to be attempting to steal credentials from local files.
Advisories for Cargo/Finch-Rust package
2026
It depended on the sha-rust crate, which appeared to be attempting to steal credentials from local files.