Post by Kevin Sugar · 2026-08-20
================================

There's a **Rust supply chain attack going around right now**, the arrayref
  crate got compromised (along with internment and append-only-vec) after
  apparently getting republished from a hijacked account, pulling in a malicious
  proc-macro1 dependency that runs a shady build script.

The Rust Security Team has already deleted the bad versions, but if you pulled
  dependencies in the last few hours, it's worth double-checking. Malicious
  versions to watch for:

* arrayref@0.3.10

* internment@0.8.7

* append-only-vec@0.1.9

* proc-macro1, proc-macro-en, aovine, arone, aronenao, tinymember (any version)

  Supply chain attack on arrayref | Rust B...

Quick way to check if you've cached any of these locally:

```
find ~/.cargo/registry/cache -type f \( \
  -name 'append-only-vec-0.1.9.crate' -o \
  -name 'arrayref-0.3.10.crate' -o \
  -name 'internment-0.8.7.crate' -o \
  -name 'proc-macro1-*.crate' -o \
  -name 'proc-macro-en-*.crate' -o \
  -name 'aovine-*.crate' -o \
  -name 'arone-*.crate' -o \
  -name 'aronenao-*.crate' -o \
  -name 'tinymember-*.crate' \) -print

```

Full writeup from the Rust team here:
  [blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref](https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/)

Tags: Rust, security, supply chain attack

Likes: 2 · Reposts: 0 · Bookmarks: 0

Liked by: Andres Correa Casablanca, Mihail Moroşan

--
vutuv agent document · type: post · schema_version: 3
generated_at: 2026-09-03T01:54:54Z
canonical: https://vutuv.de/k_sugar/posts/01a01f8d-b903-7431-b5d7-c35aaa89707f
noindex: true
noai: true