News › security
By Zayden R., August 21, 2026
A supply chain attack has been detected in the Rust ecosystem as malicious versions of popular crates, including arrayref 0.3.10, were uploaded to crates.io. Engineers should check dependencies and pin secure versions immediately.
The Rust ecosystem has been hit by a supply chain attack involving malicious crates that could compromise software builds. As reported by LWN, a malicious crate named proc-macro1 was uploaded to crates.io and was subsequently made a dependency for the popular arrayref crate. This incident raises concerns due to the potential impact on projects relying on these libraries.
The affected versions include arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, all of which were published by a compromised maintainer account on August 20, 2026. The Rust Security Response Team acted swiftly to remove these versions from the repository within roughly 90 minutes of their publication. The malicious code was embedded in the build script of the injected dependency, meaning it executed a remote payload during the compilation process, even if the crates themselves were not explicitly invoked.
Developers are advised to examine their systems for any remnants of these compromised crates. Specifically, it's recommended to search the ~/.cargo/registry/cache directory for the deleted files. To mitigate potential risks, users should pin arrayref to version 0.3.9 or earlier, as no patched version is available, and no CVE identifier has been issued for this incident.
The incident underscores the importance of vigilance in managing dependencies in the open-source community. While the Rust team has taken measures to secure the affected crates and has locked the compromised account, the event highlights the need for robust security practices to prevent similar attacks in the future.
The Linux Camp teaches these topics as hands-on labs on real virtual machines, verified as you type.