Rust Language@rust@social.rust-lang.org: ⚠️ A few hours ago, a malicious crate was discovere…

Home | Notifications | New Note | Local | Federated | Search | Logout

Note Detail

Rust Language@rust@social.rust-lang.org (2026-08-20 19:29:35)
⚠️ A few hours ago, a malicious crate was discovered on crates.io which spread as a dependency of `arrayref` and some other crates, likely due to compromised credentials. The affected versions have been deleted.

For details and how to see if you are impacted, see: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/


---Replies---

rukai :rust:@rukai@hachyderm.io (2026-08-20 19:41:48)
@rust I appreciate the work put into this response. Would be useful to have the datetime that the compromised releases were made. I'm currently assuming it happened today but that's not clear from the post.