Two popular Rust crates arrayref and append-only-vec compromised in Supply Chain Attack
aikido.dev | incident | #supply-chain | #threat-intelligence | #rust | #aikido | #backdoor | #open-source-security | #crates | #proc-macro1
Summary
Aikido flags the largest Rust crate compromise yet: arrayref, append-only-vec and internment, poisoned with a proc-macro1 build-time dependency that fetches platform-specific payloads when compiled.
Why it matters
This incident coverage highlights observed attacker activity and practical defensive lessons.
- Published
- Collected
--- id: 6608 title: "Two popular Rust crates arrayref and append-only-vec compromised in Supply Chain Attack" source_domain: aikido.dev source_url: "https://www.aikido.dev/blog/two-popular-rust-crates-arrayref-and-append-only-vec-compromised-in-supply-chain-attack" published_at: "2026-08-20T00:00:00Z" tags: ["supply-chain", "threat-intelligence", "rust", "aikido", "backdoor", "open-source-security", "crates", "proc-macro1"] phying_url: "https://phying.com/item/6608" lang: en --- # Two popular Rust crates arrayref and append-only-vec compromised in Supply Chain Attack ## Summary Aikido flags the largest Rust crate compromise yet: arrayref, append-only-vec and internment, poisoned with a proc-macro1 build-time dependency that fetches platform-specific payloads when compiled. ## Why it matters This incident coverage highlights observed attacker activity and practical defensive lessons. ## Intelligence Metadata - **Sources:** aikido.dev - **Published:** 2026-08-20T00:00:00Z - **Original:** https://www.aikido.dev/blog/two-popular-rust-crates-arrayref-and-append-only-vec-compromised-in-supply-chain-attack - **Phying News:** https://phying.com/item/6608