Why did the `nagami` crate disappear from crates.io?

82 points tomaka17 21 comments

Hello,

Yesterday evening the CI builds of my project suddenly started breaking without any apparent reason.

After looking into it, it turns out that it's because the `nagami` crate has been removed from crates.io.

If you do a Google search for "nagami rust", you can still see links to crates.io and docs.rs in the results, but following the links leads to 404 errors. Weirdly enough I also can't find the original repository on the Internet, but maybe it's private.

A brief search says that you can remove you own crate from crates.io within 72 hours of publishing, but it's definitely been more than 72 hours that it's been in my Cargo.lock.

Since there's been some malware attacks recently, I looked at the local copy of the crate that I still have on my filesystem (it's not super big), and I don't see anything potentially malicious. It also doesn't have a build script.

So what should I do now? I can't find any sort of report on the Internet of why crates have been removed. Should I assume that the crate is gone forever and remove it from my code?

While this crate in particular is not super critical (it does optimization passes on IR code), it's a bit scary that crates you depend on can just suddenly disappear from crates.io.