Rust Supply Chain Attack: Malicious Builds in arrayref, internment, append-only-vec

Fri, 21 Aug 2026 11:38:25 +0000

Engineer — Act: Check every Cargo.lock in your repos and CI pipelines for arrayref 0.3.10, internment 0.8.7, or append-only-vec 0.1.9; if any match, treat the build environment as compromised and audit outbound network connections made during cargo build runs while those versions were live.
SOC/IR — Act: Hunt for anomalous outbound connections originating from CI/CD runners or developer machines during cargo build processes; look for spawned processes or network calls to unexpected hosts initiated from the Rust toolchain during the window these malicious versions were published.
Leader — Plan: Determine whether Rust is used in your development toolchain and, if so, have engineering confirm no builds consumed the named malicious versions; this class of build-time supply chain compromise is worth adding to your vendor/dependency risk review cadence.

Build-Security on CuraSec