Daily NewsRustSecurity

Rust crates.io supply-chain attack: what developers should check now

TechgainAuthor

6 min read · 22 August 2026

A compromised crates.io publishing account pushed malicious Rust releases that could execute during normal builds. Here are the affected versions, the exposure window, and the checks teams should run now.

What happened

arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 were compromised
A typosquat named proc-macro1 carried the build-time dropper
The affected releases were online for 86 to 107 minutes
Rust's security team deleted the malicious versions and locked the account

Sources (5)

blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref
www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack
research.jfrog.com/post/arrayref-proc-macro1-crates-io
wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns
rustsec.org/advisories/RUSTSEC-2026-0262.html

📰

This story is free — just sign in

Every Techgain newsletter is 100% free. Sign in with Google to keep reading — no password, no payment, ever.

Rust crates.io supply-chain attack: what developers should check now

This story is free — just sign in

More from Techgain

OpenAI expands Daybreak with GPT-5.6-Cyber for approved defenders

Nvidia customers face higher AI server prices as demand surges

Google’s Gemma models pass one billion downloads