EUVD-2026-63780

The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

CVE-2026-77650

The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

CVE-2026-77649

The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

PT-2026-79275

The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

The Rust Project has deleted malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account published releases that added a typosquatted dependency whose build script downloaded and executed a remote payload during compilation. The affected releases are...

Malicious code in create-react-app-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ad9d14917da2cd3e79a2885cdb25d2009133fb55f9ed4bead87e677f64f7816 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Malicious versions of the arrayref Rust crate and others executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios...

MAL-2026-14317 Malicious code in fetch-webjs-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d04692f011c8f5c87f51cd80b38eeb96ef1dc9eb0f98f6c141c97c639958a7eb The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

RUSTSEC-2026-0264 `proc-macro-en` was removed from crates.io due to malicious code

We identified that proc-macro-en contained the same build script as proc-macro1 and it was part of the same supply chain attack. This crate had one single version published at 2026-08-20. The crate was removed from crates.io and related user account was locked. This crate was used as part of a...

RUSTSEC-2026-0265 `proc-macro1` was removed from crates.io due to malicious code

It was reported proc-macro1 contained a build script that would download a malicious payload. This crate had two versions, both published on 2026-08-20. The crate was removed from crates.io and related user accounts were locked. This crate was used as part of a malware campaign targeted at users ...

`arrayref` 0.3.10 was removed from crates.io due to a malicious dependency

A new version of the arrayref crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. This compromised version was published on 2026-08-20 and removed approximately 86 minutes later. It was downloaded 2,285 times, which constituted less than 10% ...

`proc-macro-en` was removed from crates.io due to malicious code

We identified that proc-macro-en contained the same build script as proc-macro1 and it was part of the same supply chain attack. This crate had one single version published at 2026-08-20. The crate was removed from crates.io and related user account was locked. This crate was used as part of a...

Malicious code in @httttt/mcp-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2914b799b1c4e540a2ff20338186041f8053fd03cc28ad544ecdb36531a33278 The package's main/bin entry contains a top-level await execAsync... that downloads a file named javaagent from...

Malicious code in arone (crates.io)

arone is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carrying a...

MAL-2026-14336 Malicious code in arrayref (crates.io)

arrayref 0.3.10 was published to crates.io from a maintainer account droundy that appears to be compromised. Unlike every prior release, 0.3.10 declares a dependency on the malicious crate proc-macro1. The arrayref source itself is unchanged genuine macro code, but Cargo compiles the declared...

Malicious code in proc_macro1 (crates.io)

proc-macro1 is a typosquat of proc-macro2 published to crates.io by the account 'dtolney', impersonating David Tolnay dtolnay. Its metadata forges authors 'David Tolnay ' and points repository at a nonexistent github.com/dtolnay/proc-macro1. The library source is a copy of proc-macro2 so dependen...

Malicious code in proc_macro_en (crates.io)

proc-macro-en is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carryin...

Malicious code in append_only_vec (crates.io)

append-only-vec 0.1.9 was published to crates.io from the same maintainer account droundy as the trojanized arrayref and internment releases, which appears to be compromised. The release adds a dependency on an attacker-controlled crate whose build script downloads and executes an...

Malicious code in internment (crates.io)

internment 0.8.7 was published to crates.io from the same maintainer account droundy as the trojanized arrayref and append-only-vec releases, which appears to be compromised. The release adds a dependency on an attacker-controlled crate whose build script downloads and executes an...

CVE-2026-76139 Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentials

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build...