vutuv
Log in

Post by Kevin Sugar

Kevin Sugar

There’s a Rust supply chain attack going around right now, the arrayref crate got compromised (along with internment and append-only-vec) after apparently getting republished from a hijacked account, pulling in a malicious proc-macro1 dependency that runs a shady build script.

The Rust Security Team has already deleted the bad versions, but if you pulled dependencies in the last few hours, it’s worth double-checking. Malicious versions to watch for:

  • arrayref@0.3.10

  • internment@0.8.7

  • append-only-vec@0.1.9

  • proc-macro1, proc-macro-en, aovine, arone, aronenao, tinymember (any version)

    Supply chain attack on arrayref | Rust B…

Quick way to check if you’ve cached any of these locally:

find ~/.cargo/registry/cache -type f \( \
  -name 'append-only-vec-0.1.9.crate' -o \
  -name 'arrayref-0.3.10.crate' -o \
  -name 'internment-0.8.7.crate' -o \
  -name 'proc-macro1-*.crate' -o \
  -name 'proc-macro-en-*.crate' -o \
  -name 'aovine-*.crate' -o \
  -name 'arone-*.crate' -o \
  -name 'aronenao-*.crate' -o \
  -name 'tinymember-*.crate' \) -print

Full writeup from the Rust team here: blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref

Rust security supply chain attack
Liked by Andres Correa Casablanca and 1 other

Other formats

Markdown Text only JSON XML