append-only-vec

Attackers published malicious versions of three Rust crates—arrayref, internment, and append-only-vec—through a compromised publishing account associated with David Roundy on August 20th, turning rout…

An engineer at Softjourn nearly installed a malicious package recommended by an AI agent, but company policy requiring verification on GitHub prevented the installation. Separately, security researche…

Socket's Threat Research Team detected a coordinated supply chain attack on August 20, 2026, in which three legitimate Rust crates—arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9—were rep…