Malicious dependency injection discovered in Rust crates.io packages

On August 20, 2026, the Rust Security Response Team confirmed a supply chain attack involving malicious versions of the proc-macro1 crate and its dependencies. The attack occurred when an apparently compromised developer account published tainted updates to arrayref (0.3.10), internment (0.8.7), and append-only-vec (0.1.9) that pulled in malicious payloads through build scripts. All affected versions were available for 86-107 minutes before being detected and removed. While the original crate authors aren't suspected of malicious intent, their credentials appear compromised. Developers should audit their dependency trees using provided command-line checks to ensure they haven't pulled the affected versions during the exposure window. The response team has locked the suspicious account and restored clean versions of the packages.