01a01f8d-b903-7431-b5d7-c35aaa89707f post 01a01f8d-b903-7431-b5d7-c35aaa89707f 0 Kevin Sugar https://vutuv.de/k_sugar/posts/01a01f8d-b903-7431-b5d7-c35aaa89707f 2026-08-20 k_sugar There's a **Rust supply chain attack going around right now**, the arrayref crate got compromised (along with internment and append-only-vec) after apparently getting republished from a hijacked account, pulling in a malicious proc-macro1 dependency that runs a shady build script. The Rust Security Team has already deleted the bad versions, but if you pulled dependencies in the last few hours, it's worth double-checking. Malicious versions to watch for: * arrayref@0.3.10 * internment@0.8.7 * append-only-vec@0.1.9 * proc-macro1, proc-macro-en, aovine, arone, aronenao, tinymember (any version) Supply chain attack on arrayref | Rust B... Quick way to check if you've cached any of these locally: ``` find ~/.cargo/registry/cache -type f \( \ -name 'append-only-vec-0.1.9.crate' -o \ -name 'arrayref-0.3.10.crate' -o \ -name 'internment-0.8.7.crate' -o \ -name 'proc-macro1-*.crate' -o \ -name 'proc-macro-en-*.crate' -o \ -name 'aovine-*.crate' -o \ -name 'arone-*.crate' -o \ -name 'aronenao-*.crate' -o \ -name 'tinymember-*.crate' \) -print ``` Full writeup from the Rust team here: [blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref](https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/) There's a **Rust supply chain attack going around right now**, the arrayref crate got compromised (along with internment and append-only-vec) after apparently getting republished from a hijacked accou Kevin Sugar k_sugar https://vutuv.de/k_sugar https://vutuv.de/k_sugar/posts/01a01f8d-b903-7431-b5d7-c35aaa89707f https://vutuv.de/k_sugar/posts/01a01f8d-b903-7431-b5d7-c35aaa89707f.json https://vutuv.de/k_sugar/posts/01a01f8d-b903-7431-b5d7-c35aaa89707f.txt https://vutuv.de/k_sugar/posts/01a01f8d-b903-7431-b5d7-c35aaa89707f.md https://vutuv.de/k_sugar/posts/01a01f8d-b903-7431-b5d7-c35aaa89707f.xml Rust security supply chain attack 2026-09-03T01:54:20Z 3 2026-08-20 2 0 0 There's a **Rust supply chain attack going around right now**, the arrayref crate got compromised (along with internment and append-only-vec) after apparently getting republished from a hijacked account, pulling in a malicious proc-macro1 dependency that runs a shady build script. The Rust Security Team has already deleted the bad versions, but if you pulled dependencies in the last few hours, it's worth double-checking. Malicious versions to watch for: * arrayref@0.3.10 * internment@0.8.7 * append-only-vec@0.1.9 * proc-macro1, proc-macro-en, aovine, arone, aronenao, tinymember (any version) Supply chain attack on arrayref | Rust B... Quick way to check if you've cached any of these locally: ``` find ~/.cargo/registry/cache -type f \( \ -name 'append-only-vec-0.1.9.crate' -o \ -name 'arrayref-0.3.10.crate' -o \ -name 'internment-0.8.7.crate' -o \ -name 'proc-macro1-*.crate' -o \ -name 'proc-macro-en-*.crate' -o \ -name 'aovine-*.crate' -o \ -name 'arone-*.crate' -o \ -name 'aronenao-*.crate' -o \ -name 'tinymember-*.crate' \) -print ``` Full writeup from the Rust team here: [blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref](https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/) 0 0 0 0 Andres Correa Casablanca andreu https://vutuv.de/andreu Mihail Moroşan morosanmihail https://vutuv.de/morosanmihail 0 false