the response time of the rust team was extremely quick, great job!

2017-09-13 @ 19:19 - Justin sends mail to security@rust-lang.org about this

2017-09-13 @ 19:28 - response sent to Justin acknowledging the vulnerability

2017-09-13 @ 21:14 - a patch to crates.io was finished, all current tarballs verified not-malicious