Strange crate in `my crates` section


#1

Everytime I open my crates page on crates.io during last week I see a crate which is not mine, I did not even knew about it before - cargo-canoe. The web page looks like that:

All the version are yanked, I have googled somehow it’s source code and it is a simple binary application which draw something in the terminal. What is this, why is it in my crates section? How can I delete it?


#2

I believe it was an experiment to show how you can do possibly malicious things on crates.io. In this case, adding people as developers on a crate without their permission.

I don’t know how you’d remove yourself from a crate, or even if it’s possible. Perhaps someone who works with crates.io would know?

cc: @carols10cents @steveklabnik


#3

There was some discussion of this here:


#4

You can indeed remove yourself as an owner, as long as there’s at least one other owner, using cargo owner --remove yourusername cratename. And in fact you have already been removed, we just have a bug that shows deleted records on your owners page, the fix for which is up but hasn’t been deployed yet.