Malicious arrayref, internment and append-only-vec releases ran code at Rust build time
The malicious releases executed arbitrary code at build time on any machine that resolved them during the 86–107 minute window on August 20, so build agents and developer laptops that pulled them yesterday may already have leaked CI secrets and need credential rotation now.
A compromised crates.io maintainer account published arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 on 2026-08-20, each adding a typosquatted dependency whose build script downloaded and executed a remote payload during compilation. Because the payload lived in a build script, merely resolving and compiling the dependency was enough to run it — no crate function had to be called. The Rust Project removed all three releases within roughly 86 to 107 minutes; the crates involved have around 245 million cumulative downloads, and researchers report overlap with DPRK-linked campaigns.
Affected: arrayref 0.3.10; internment 0.8.7; append-only-vec 0.1.9
How to Test
Grep Cargo.lock, vendored dependency trees and build logs across repos and CI for "arrayref 0.3.10", "internment 0.8.7" and "append-only-vec 0.1.9", and search ~/.cargo/registry/cache (and CI cache volumes) for the deleted .crate files plus any unexpected typosquatted dependency and outbound network connections from build-script processes on 2026-08-20.
How to Mitigate
Downgrade or pin to the last known-good versions of the three crates, purge ~/.cargo/registry cache and CI dependency caches, rebuild affected artifacts from clean runners, and rotate registry tokens, cloud keys, SSH keys and any other secrets available to build environments that compiled the malicious releases.