vutuv
Log in

supply chain attack

Tags

Follow from the Fediverse

Follow #supply_chain_attack from Mastodon or any other Fediverse app and its public posts arrive in your timeline. No vutuv account needed.

@supply_chain_attack@tags.vutuv.de

Your address is used once, to send you to your own server's follow dialog. It is never stored here.

Posts with this tag

1 post

Filters
Kevin Sugar

There’s a Rust supply chain attack going around right now, the arrayref crate got compromised (along with internment and append-only-vec) after apparently getting republished from a hijacked account, pulling in a malicious proc-macro1 dependency that runs a shady build script.

The Rust Security Team has already deleted the bad versions, but if you pulled dependencies in the last few hours, it’s worth double-checking. Malicious versions to watch for:

  • arrayref@0.3.10

  • internment@0.8.7

  • append-only-vec@0.1.9

  • proc-macro1, proc-macro-en, aovine, arone, aronenao, tinymember (any version)

    Supply chain attack on arrayref | Rust B…

Quick way to check if you’ve cached any of these locally:

find ~/.cargo/registry/cache -type f \( \
  -name 'append-only-vec-0.1.9.crate' -o \
  -name 'arrayref-0.3.10.crate' -o \
  -name 'internment-0.8.7.crate' -o \
  -name 'proc-macro1-*.crate' -o \
  -name 'proc-macro-en-*.crate' -o \
  -name 'aovine-*.crate' -o \
  -name 'arone-*.crate' -o \
  -name 'aronenao-*.crate' -o \
  -name 'tinymember-*.crate' \) -print

Full writeup from the Rust team here: blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref

Rust security supply chain attack
Rust security supply chain attack