`arrayref` 0.3.10 was removed from crates.io due to a malicious dependency

A new version of the arrayref crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. This compromised version was published on 2026-08-20 and removed approximately 86 minutes later. It was downloaded 2,285 times, which constituted less than 10% ...

MAL-2026-14333 Malicious code in append_only_vec (crates.io)

append-only-vec 0.1.9 was published to crates.io from the same maintainer account droundy as the trojanized arrayref and internment releases, which appears to be compromised. The release adds a dependency on an attacker-controlled crate whose build script downloads and executes an...

Linux Distros Unpatched Vulnerability : CVE-2026-5223

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of...