Act
active
Rust Supply Chain Attack: Malicious Builds in arrayref, internment, append-only-vec
- Engineer — Act: Check every Cargo.lock in your repos and CI pipelines for arrayref 0.3.10, internment 0.8.7, or append-only-vec 0.1.9; if any match, treat the build environment as compromised and audit outbound network connections made during
cargo buildruns while those versions were live. - SOC/IR — Act: Hunt for anomalous outbound connections originating from CI/CD runners or developer machines during
cargo buildprocesses; look for spawned processes or network calls to unexpected hosts initiated from the Rust toolchain during the window these malicious versions were published. - Leader — Plan: Determine whether Rust is used in your development toolchain and, if so, have engineering confirm no builds consumed the named malicious versions; this class of build-time supply chain compromise is worth adding to your vendor/dependency risk review cadence.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.