# Supply chain attack on arrayref

DevFeed: [Supply chain attack on arrayref](<https://devfeed.tech/articles/supply-chain-attack-on-arrayref-2349.md>)

Original publisher: [Read original article](<https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/>)

Author: Manish Goregaokar

Published: 2026-08-20T00:00:00Z

Content type: news

Language: en

Sources: [Rust Blog](<https://devfeed.tech/sources/rust-blog.md>)

Topics: [Rust](<https://devfeed.tech/topics/rust.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [local](<https://devfeed.tech/tags/local.md>), [payload](<https://devfeed.tech/tags/payload.md>), [research](<https://devfeed.tech/tags/research.md>), [rust](<https://devfeed.tech/tags/rust.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>)

## AI overview

The Rust Security Response Team confirmed a supply-chain attack involving malicious crates. A compromised build script downloaded a malicious payload, leading to the deletion or yanking of affected versions and the locking of a potentially compromised account. Developers are advised to inspect their local Cargo registry cache for the listed crates and versions.

## Source excerpt

What happened On 2026-08-20 at 7:15 UTC we got a report that the proc-macro1 crate was malicious. The Rust Security Response Team verified this to be the case: the crate had a build script that was downloading a malicious payload. This crate proc-macro1 and others like it (proc-macro-en, aovine, arone, aronenao, tinymember) have been deleted. Furthermore, we discovered that the popular arrayref crate had recently been republished and made to depend on this crate, with the most recent versions yanked. We have removed the malicious version and unyanked the maliciously-yanked versions. Other crates by that author (internment, append-only-vec) were also affected so we have done the same for those, and locked the account as a precaution. We do not believe the author of arrayref to be acting maliciously, but their computer or credentials are likely compromised, and we are attempting to contact them. What you need to do We recommend you check your local dependencies to ensure these crates were not pulled in. Here are the malicious versions that we deleted from crates.io: append-only-vec@0.1.9: published at 2026-08-20T07:37:49Z, deleted at 2026-08-20T09:25:24Z. Online for 107 minutes. arrayref@0.3.10: published at 2026-08-20T07:15:00Z, deleted at 2026-08-20T08:41:40Z. Online for 86 minutes. internment@0.8.7: published at 2026-08-20T07:34:07Z, deleted at 2026-08-20T09:04:11Z. Online for 90 minutes. proc-macro1, proc-macro-en, aovine, arone, aronenao, tinymember (any versions). You can quickly check if these crates have been used locally by going through ~/.cargo/registry/cache with this command: find ~/.cargo/registry/cache -type f \( \ -name 'append-only-vec-0.1.9.crate' -o \ -name 'arrayref-0.3.10.crate' -o \ -name 'internment-0.8.7.crate' -o \ -name 'proc-macro1-*.crate' -o \ -name 'proc-macro-en-*.crate' -o \ -name 'aovine-*.crate' -o \ -name 'arone-*.crate' -o \ -name 'aronenao-*.crate' -o \ -name 'tinymember-*.crate' \ \) -print Thanks We'd like to thank the Research T