Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
After a compromised maintainer account issued releases that included a typosquatted dependency whose build script downloaded and ran a remote payload during compilation, the Rust Project removed harmful versions of three popular Rust crates from crates.io.
The impacted releases, arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, were all withdrawn in 86 to 107 minutes after being published from the same owner account on August 20, 2026.
Building a project that fixed the malicious code in the injected dependency's build script was enough to execute the payload; nothing from the crates themselves needed to be invoked.
After the Rust Security Response Team unyanked the maliciously-yanked versions during the response, developers are recommended to pin arrayref at 0.3.9 or ...