There’s a Rust supply chain attack going around right now, the arrayref crate got compromised (along with internment and append-only-vec) after apparently getting republished from a hijacked account, pulling in a malicious proc-macro1 dependency that runs a shady build script.

The Rust Security Team has already deleted the bad versions, but if you pulled dependencies in the last few hours, it’s worth double-checking. Malicious versions to watch for:

• arrayref@0.3.10

• internment@0.8.7

• append-only-vec@0.1.9

• proc-macro1, proc-macro-en, aovine, arone, aronenao, tinymember (any version)

  Supply chain attack on arrayref | Rust B…

Quick way to check if you’ve cached any of these locally:

find ~/.cargo/registry/cache -type f \( \
  -name 'append-only-vec-0.1.9.crate' -o \
  -name 'arrayref-0.3.10.crate' -o \
  -name 'internment-0.8.7.crate' -o \
  -name 'proc-macro1-*.crate' -o \
  -name 'proc-macro-en-*.crate' -o \
  -name 'aovine-*.crate' -o \
  -name 'arone-*.crate' -o \
  -name 'aronenao-*.crate' -o \
  -name 'tinymember-*.crate' \) -print

Full writeup from the Rust team here: blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref