{
  "id": "01a01f8d-b903-7431-b5d7-c35aaa89707f",
  "type": "post",
  "thread": [
    {
      "id": "01a01f8d-b903-7431-b5d7-c35aaa89707f",
      "depth": 0,
      "author": "Kevin Sugar",
      "url": "https://vutuv.de/k_sugar/posts/01a01f8d-b903-7431-b5d7-c35aaa89707f",
      "published_on": "2026-08-20",
      "in_reply_to_id": null,
      "author_username": "k_sugar",
      "body_markdown": "There's a **Rust supply chain attack going around right now**, the arrayref crate got compromised (along with internment and append-only-vec) after apparently getting republished from a hijacked account, pulling in a malicious proc-macro1 dependency that runs a shady build script.\n\nThe Rust Security Team has already deleted the bad versions, but if you pulled dependencies in the last few hours, it's worth double-checking. Malicious versions to watch for:\n\n* arrayref@0.3.10\n\n* internment@0.8.7\n\n* append-only-vec@0.1.9\n\n* proc-macro1, proc-macro-en, aovine, arone, aronenao, tinymember (any version)\n\n  Supply chain attack on arrayref | Rust B...\n\nQuick way to check if you've cached any of these locally:\n\n```\nfind ~/.cargo/registry/cache -type f \\( \\\n  -name 'append-only-vec-0.1.9.crate' -o \\\n  -name 'arrayref-0.3.10.crate' -o \\\n  -name 'internment-0.8.7.crate' -o \\\n  -name 'proc-macro1-*.crate' -o \\\n  -name 'proc-macro-en-*.crate' -o \\\n  -name 'aovine-*.crate' -o \\\n  -name 'arone-*.crate' -o \\\n  -name 'aronenao-*.crate' -o \\\n  -name 'tinymember-*.crate' \\) -print\n\n```\n\nFull writeup from the Rust team here: [blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref](https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/)",
      "in_reply_to_author": null
    }
  ],
  "description": "There's a **Rust supply chain attack going around right now**, the arrayref crate got compromised (along with internment and append-only-vec) after apparently getting republished from a hijacked accou",
  "title": "Kevin Sugar · 2026-08-20",
  "author": {
    "name": "Kevin Sugar",
    "username": "k_sugar",
    "url": "https://vutuv.de/k_sugar"
  },
  "replies": [],
  "url": "https://vutuv.de/k_sugar/posts/01a01f8d-b903-7431-b5d7-c35aaa89707f",
  "formats": {
    "json": "https://vutuv.de/k_sugar/posts/01a01f8d-b903-7431-b5d7-c35aaa89707f.json",
    "text": "https://vutuv.de/k_sugar/posts/01a01f8d-b903-7431-b5d7-c35aaa89707f.txt",
    "markdown": "https://vutuv.de/k_sugar/posts/01a01f8d-b903-7431-b5d7-c35aaa89707f.md",
    "xml": "https://vutuv.de/k_sugar/posts/01a01f8d-b903-7431-b5d7-c35aaa89707f.xml"
  },
  "tags": [
    "Rust",
    "security",
    "supply chain attack"
  ],
  "in_reply_to": null,
  "generated_at": "2026-09-03T01:54:22Z",
  "schema_version": 3,
  "published_on": "2026-08-20",
  "images": [],
  "like_count": 2,
  "license": null,
  "review": null,
  "fediverse_reaction_count": 0,
  "reply_count": 0,
  "fediverse_replies": [],
  "body_markdown": "There's a **Rust supply chain attack going around right now**, the arrayref crate got compromised (along with internment and append-only-vec) after apparently getting republished from a hijacked account, pulling in a malicious proc-macro1 dependency that runs a shady build script.\n\nThe Rust Security Team has already deleted the bad versions, but if you pulled dependencies in the last few hours, it's worth double-checking. Malicious versions to watch for:\n\n* arrayref@0.3.10\n\n* internment@0.8.7\n\n* append-only-vec@0.1.9\n\n* proc-macro1, proc-macro-en, aovine, arone, aronenao, tinymember (any version)\n\n  Supply chain attack on arrayref | Rust B...\n\nQuick way to check if you've cached any of these locally:\n\n```\nfind ~/.cargo/registry/cache -type f \\( \\\n  -name 'append-only-vec-0.1.9.crate' -o \\\n  -name 'arrayref-0.3.10.crate' -o \\\n  -name 'internment-0.8.7.crate' -o \\\n  -name 'proc-macro1-*.crate' -o \\\n  -name 'proc-macro-en-*.crate' -o \\\n  -name 'aovine-*.crate' -o \\\n  -name 'arone-*.crate' -o \\\n  -name 'aronenao-*.crate' -o \\\n  -name 'tinymember-*.crate' \\) -print\n\n```\n\nFull writeup from the Rust team here: [blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref](https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/)",
  "bookmark_count": 0,
  "fediverse_like_count": 0,
  "fediverse_reactions": [],
  "fediverse_reply_count": 0,
  "fediverse_repost_count": 0,
  "likers": [
    {
      "name": "Andres Correa Casablanca",
      "username": "andreu",
      "url": "https://vutuv.de/andreu"
    },
    {
      "name": "Mihail Moroşan",
      "username": "morosanmihail",
      "url": "https://vutuv.de/morosanmihail"
    }
  ],
  "repost_count": 0,
  "thread_truncated": false,
  "verified_author_links": []
}