Malicious Code Injection in sharpnes Package: Data Exfiltration Vulnerability
Summary
MAL-2026-17713: Malicious code in sharpnes (crates.io). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sharpnes package, available on crates.io, is designed for educational purposes, as indicated by its description 'The sharpnes project is a learn.' However, it has been compromised by malicious actors, leading to serious security concerns. The package contains functions that, when executed, can steal sensitive user data from systems running Windows, Linux, and macOS.
Vulnerability Detail
The sharpnes package versions 0.1.0 and 0.1.1 contain malicious code that acts as an infostealer. When the exported async function shortname() is invoked, it triggers the collection of sensitive data, including Telegram Desktop session data and Chrome browser extension settings. This data is then zipped and sent to attacker-controlled Telegram bots using hardcoded bot tokens. The vulnerability arises from the embedded malicious code that exploits the package's functionality, posing significant risks to user privacy and data security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid invoking the shortname() function in your code. However, the best practice is to remove the sharpnes package entirely to prevent any risk of data exfiltration.
Conclusion
The sharpnes package has been compromised with malicious code that poses a significant threat to user data security. It is essential to remove this package from your projects and monitor for vulnerabilities using tools like Vulert to ensure ongoing protection against such threats.
See every vulnerability recorded for sharpnes →
FAQ
The sharpnes package is an open-source crate on crates.io, initially intended for educational purposes.
The vulnerability allows malicious code to exfiltrate sensitive data from your system to attacker-controlled Telegram bots.
The malicious code collects Telegram Desktop session data and Chrome browser extension settings, which may include sensitive information.
No, there are no patched versions of the sharpnes package available. The only solution is to remove the package.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check your application against known vulnerabilities using the Vulert playground without any signup.
