Home | Notifications | New Note | Local | Federated | Search | Logout

Note Detail

Rust Language@rust@social.rust-lang.org (2026-08-20 19:29:35)
⚠️ A few hours ago, a malicious crate was discovered on crates.​io which spread as a dependency of `arrayref` and some other crates, likely due to compromised credentials. The affected versions have been deleted.

For details and how to see if you are impacted, see: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
---Reply---
rukai :rust:@rukai@hachyderm.io (2026-08-20 19:41:48)
@rust I appreciate the work put into this response. Would be useful to have the datetime that the compromised releases were made. I'm currently assuming it happened today but that's not clear from the post.

---Replies---

Rust Language@rust@social.rust-lang.org (2026-08-20 20:02:07)
@rukai The malicious dependency (`proc-macro1`) was published today at 01:55 UTC. We deleted it six hours later at 08:03 UTC.

We'll also investigate the publication times of the affected crates (`arrayref` etc.) and add this information to the blog post.