- Engineer — Act: Check every Cargo.lock in your repos and CI pipelines for arrayref 0.3.10, internment 0.8.7, or append-only-vec 0.1.9; if any match, treat the build environment as compromised and audit outbound network connections made during
cargo build runs while those versions were live. - SOC/IR — Act: Hunt for anomalous outbound connections originating from CI/CD runners or developer machines during
cargo build processes; look for spawned processes or network calls to unexpected hosts initiated from the Rust toolchain during the window these malicious versions were published. - Leader — Plan: Determine whether Rust is used in your development toolchain and, if so, have engineering confirm no builds consumed the named malicious versions; this class of build-time supply chain compromise is worth adding to your vendor/dependency risk review cadence.