The Rust Project removed malicious releases of arrayref, internment, and append-only-vec after a compromised maintainer account published typosquatted dependencies that executed a remote payload during build time. The incident abused proc-macro1 to bypass normal build expectations, and the Rust Security Response Team advised developers to inspect local cargo caches and pin arrayref to 0.3.9 or earlier. #RustProject #arrayref #internment #append-only-vec #proc-macro1
Keypoints
- Malicious versions of three Rust crates were removed from crates.io shortly after publication.
- A compromised maintainer account added a typosquatted proc-macro1 dependency.
- The injected build script downloaded and ran a payload during compilation.
- Developers were told to check ~/.cargo/registry/cache and pin arrayref to 0.3.9 or earlier.
- No CVE was assigned, and there is no evidence the malicious versions were used.
Read More: https://thehackernews.com/2026/08/rust-supply-chain-attack-puts-build.html