---
title: "Kevin Sugar · 2026-08-20"
description: "There's a **Rust supply chain attack going around right now**, the arrayref crate got compromised (along with internment and append-only-vec) after apparently getting republished from a hijacked accou"
url: https://vutuv.de/k_sugar/posts/01a01f8d-b903-7431-b5d7-c35aaa89707f
type: post
schema_version: 3
generated_at: 2026-09-03T01:54:28Z
noindex: true
noai: true
---

# Post by [Kevin Sugar](https://vutuv.de/k_sugar) · 2026-08-20

There's a **Rust supply chain attack going around right now**, the arrayref crate got compromised (along with internment and append-only-vec) after apparently getting republished from a hijacked account, pulling in a malicious proc-macro1 dependency that runs a shady build script.

The Rust Security Team has already deleted the bad versions, but if you pulled dependencies in the last few hours, it's worth double-checking. Malicious versions to watch for:

* arrayref@0.3.10

* internment@0.8.7

* append-only-vec@0.1.9

* proc-macro1, proc-macro-en, aovine, arone, aronenao, tinymember (any version)

  Supply chain attack on arrayref | Rust B...

Quick way to check if you've cached any of these locally:

```
find ~/.cargo/registry/cache -type f \( \
  -name 'append-only-vec-0.1.9.crate' -o \
  -name 'arrayref-0.3.10.crate' -o \
  -name 'internment-0.8.7.crate' -o \
  -name 'proc-macro1-*.crate' -o \
  -name 'proc-macro-en-*.crate' -o \
  -name 'aovine-*.crate' -o \
  -name 'arone-*.crate' -o \
  -name 'aronenao-*.crate' -o \
  -name 'tinymember-*.crate' \) -print

```

Full writeup from the Rust team here: [blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref](https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/)

Tags: #Rust, #security, #supply chain attack

Likes: 2 · Reposts: 0 · Bookmarks: 0

Liked by: Andres Correa Casablanca, Mihail Moroşan