Popular Rust Crates Compromised in Build-Time Supply Chain Attack

Reported 20 Aug 2026 by otx · Severity: medium

A coordinated supply chain attack compromised three legitimate Rust crates maintained by David Roundy: arrayref, internment, and append-only-vec. The threat actor injected a malicious dependency called proc-macro1, a typosquat of the legitimate proc-macro2 crate. This malicious p