Rust Security Response Team

Attackers published malicious versions of three Rust crates—arrayref, internment, and append-only-vec—through a compromised publishing account associated with David Roundy on August 20th, turning rout…

Socket's Threat Research Team detected a coordinated supply chain attack on August 20, 2026, in which three legitimate Rust crates—arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9—were rep…