I didn't. And I was specifically referring to the published "analysis".

How do we know the supposedly malicious content (which hasn't provably affected a single person) a security company finds, didn't originate from that same company?

• Crates NO ONE uses or ever used.
• "with over 7,000 all-time downloads" immediately mentioned to make it sound like the above is not the case.
• Our "AI" found a malicious base64 (wow, very fancy)!
• Muh supply chain!
• bla bla China bla bla

It all sounds like a joke, and a lazily written one at that (Edit for fairness: the ctor part was a nice touch tbf).

And this is not limited to this analysis, or this company, or the Rust ecosystem. The era of CVE logos and all that theater can become rather tiring, and AI slop took the silliness to a whole other level. Or as our friend Daniel puts it, it's a "Death by a thousand slops".