Rust arrayref 0.3.10 crate installs malware

Sign inAppearance settingsPlatformAI CODE CREATIONGitHub CopilotWrite better code with AIGitHub Copilot appDirect agents from issue to mergeMCP RegistryIntegrate external toolsDEVELOPER WORKFLOWSActionsAutomate any workflowCodespacesInstant dev environmentsIssuesPlan and track workCode ReviewManage code changesCode QualityEnforce quality at mergeAPPLICATION SECURITYGitHub Advanced SecurityFind and fix vulnerabilitiesCode securitySecure your code as you buildSecret protectionStop leaks before they startEXPLOREWhy GitHubDocumentationBlogChangelogMarketplaceView all featuresSolutionsBY COMPANY SIZEEnterprisesSmall and medium teamsStartupsNonprofitsBY USE CASEApp ModernizationDevSecOpsDevOpsCI/CDView all use casesBY INDUSTRYHealthcareFinancial servicesManufacturingGovernmentView all industriesView all solutionsResourcesEXPLORE BY TOPICAISoftware DevelopmentDevOpsSecurityView all topicsEXPLORE BY TYPECustomer storiesEvents & webinarsEbooks & reportsBusiness insightsGitHub SkillsSUPPORT & SERVICESDocumentationCustomer supportCommunity forumTrust centerPartnersView all resourcesOpen SourceCOMMUNITYGitHub SponsorsFund open source developersPROGRAMSSecurity LabMaintainer CommunityAcceleratorGitHub StarsArchive ProgramREPOSITORIESTopicsTrendingCollectionsEnterpriseENTERPRISE SOLUTIONSEnterprise platformAI-powered developer platformAVAILABLE ADD-ONSGitHub Advanced SecurityEnterprise-grade security featuresCopilot for BusinessEnterprise-grade AI featuresPremium SupportEnterprise-grade 24/7 supportPricingSearch/Sign inSign upAppearance settings You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert {{ message }} Uh oh! There was an error while loading. Please reload this page.

rustsec / advisory-db Public Notifications You must be signed in to change notification settings Fork 525 Star 1.2k Code Issues 61 Pull requests 84 Discussions Actions Projects Security and quality 0 Insights Additional navigation options Code Issues Pull requests Discussions Actions Projects Security and quality Insights {"payload":{"preloaded_records":{},"structured_data":{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Malware: `arrayref` 0.3.10 executes a remote payload at build time via typosquatted `proc-macro1`","articleBody":"`arrayref` 0.3.10 (2026-08-20 07:15 UTC, by `droundy`) adds a first-ever\ndependency on `proc-macro1` 1.0.107 (07:11 UTC, by `dtolney`), whose `build.rs`\ndownloads and executes a remote binary. Both are live as I file this;\[email protected] emailed separately.\n\n**Affected:** `arrayref` =0.3.10, `proc-macro1` all versions. 1.0.106 is a clean\ncopy of proc-macro2 published 5h earlier — staging, but not itself malicious.\n`arrayref` ≤0.3.9 are clean.\n\n**Reach:** `tiny-skia` → `sctk-adwaita` → `winit`, so under egui/eframe, iced,\nand most Rust GUI work. 0.3.9 has ~152M downloads.\n\n**Delivery:** 0.3.5–0.3.9 are all yanked under the owner account, so cargo's\n`consider updating to a version that is not yanked` warning is the lure. That is\nhow I hit it. `droundy` is presumably compromised.\n\n## Payload — `proc-macro1-1.0.107/build.rs`\n\n```rust\nconst SRC_URL_PARTS: \u0026[\u0026str] =\n \u0026[\"aHR0cHM6Ly8=\", \"MjMuMjU0Lg==\", \"MTY1Lg==\", \"MTEyOg==\", \"OTA4OS8=\"];\nconst END_URL_PARTS: \u0026[\u0026str] =\n \u0026[\"MjMuMjU0Lg==\", \"MTY1Lg==\", \"MTEyOg==\", \"NDQz\"];\n```\n\n→ `https://23.254.165.112:9089/`, `23.254.165.112:443`. Fetched over rustls with\nan `AcceptAll` `ServerCertVerifier` (all three verify methods return success\nunconditionally), selecting `rust-crate_0.1.0`/`_0.2.0`/`_0.3.0`/`_0.4.0` by\ntarget, then executed with the second URL as argv[1]:\n\n- Unix: `/tmp/rust-setup`, `chmod +x`, detached spawn, stdio null.\n- Windows: `%TEMP%\\rust-setup.ps1` via a `%TEMP%\\rust-setup-launch.vbs` launcher\n under `wscript.exe //B //Nologo` + `CREATE_NO_WINDOW`, then\n `std::mem::forget(child)` — commented in-source as escaping cargo's job object\n so the build does not wait on it.\n\n`src/` is genuine proc-macro2, so builds succeed normally. Metadata forges\n`authors = [\"David Tolnay \[email protected]\u003e\"]` and\n`repository = \".../dtolnay/proc-macro1\"` (404).\n\n## IOCs\n\n```\n23.254.165.112:9089 payload host\n23.254.165.112:443 C2 (argv[1])\n/tmp/rust-setup\n%TEMP%\\rust-setup.ps1 , rust-setup-launch.vbs\nrust-crate_0.1.0 / _0.2.0 / _0.3.0 / _0.4.0\n\nsha256\n arrayref 0.3.10 25ad700976873c76af785cb99b33c48db7df8b81f21d1e9e06b3676b9a9373ae\n proc-macro1 1.0.107 61198155da51b838772eecf5bfaac6cbc4dcc388dccc56658fc28a8e831b34d4\n proc-macro1 1.0.106 b5c1b5b0763a8809a644a8f92224653f0aca623a98eecc714d27f74b80fbe436\n```\n","author":{"url":"https://github.com/jhobern","@type":"Person","name":"jhobern"},"datePublished":"2026-08-20T07:54:11.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":8},"url":"https://github.com/3161/advisory-db/issues/3161"},"best_match_sort_enabled":false,"issue_search_type":"ISSUE_HYBRID","preloadedQueries":[{"queryId":"2e5c3156ee2403a0e719ecad51254908","queryName":"IssueViewerViewQuery","variables":{"count":15,"number":3161,"owner":"rustsec","repo":"advisory-db"},"result":{"data":{"repository":{"id":"MDEwOlJlcG9zaXRvcnk4MzE1MzU2MQ==","isOwnerEnterpriseManaged":false,"owner":{"__typename":"Organization","userNameDisplayConfiguration":"HANDLE","id":"MDEyOk9yZ2FuaXphdGlvbjI1Mzk3MjQy"},"issue":{"id":"I_kwDOBPTSmc8AAAABNgH5Qg","number":3161,"viewerCanUpdateMetadata":false,"repository":{"id":"MDEwOlJlcG9zaXRvcnk4MzE1MzU2MQ==","databaseId":83153561,"name":"advisory-db","isArchived":false,"nameWithOwner":"rustsec/advisory-db","viewerCanInteract":false,"viewerInteractionLimitReasonHTML":"","slashCommandsEnabled":false,"visibility":"PUBLIC","viewerCanPush":false,"owner":{"__typename":"Organization","login":"rustsec","id":"MDEyOk9yZ2FuaXphdGlvbjI1Mzk3MjQy","url":"https://github.com/rustsec","databaseId":25397242,"issueFields":{"totalCount":0},"pinnedIssueFields":{"nodes":[]}},"isPrivate":false,"isWritable":true,"isOwnerEnterpriseManaged":false,"viewerCanPinIssues":false,"isCopilotAgentEnabled":null,"issueTypes":{"edges":[{"node":{"id":"IT_kwDOAYOH-s4AVt3g"}},{"node":{"id":"IT_kwDOAYOH-s4AVt3j"}},{"node":{"id":"IT_kwDOAYOH-s4AVt3k"}}]},"pinnedIssues":{"totalCount":1},"viewerIssueCreationPermissions":{"triageable":false}},"updatedAt":"2026-08-20T15:02:58Z","titleHTML":"Malware: \u003ccode\u003earrayref\u003c/code\u003e 0.3.10 executes a remote payload at build time via typosquatted \u003ccode\u003eproc-macro1\u003c/code\u003e","url":"https://github.com/rustsec/advisory-db/issues/3161","viewerCanUpdateNext":false,"issueType":null,"duplicateOf":null,"linkedPullRequests":{"nodes":[]},"agentAssignments":[],"closedByPullRequestsReferences":{"nodes":[]},"labels":{"pageInfo":{"hasNextPage":false,"endCursor":null},"edges":[]},"milestone":null,"assignedActors":{"nodes":[]},"locked":false,"viewerCanComment":false,"databaseId":5201066306,"state":"CLOSED","stateReason":"NOT_PLANNED","title":"Malware: `arrayref` 0.3.10 executes a remote payload at build time via typosquatted `proc-macro1`","createdAt":"2026-08-20T07:54:11Z","viewerDidAuthor":false,"author":{"avatarUrl":"https://avatars.githubusercontent.com/u/3775936?v=4","login":"jhobern","id":"MDQ6VXNlcjM3NzU5MzY=","profileUrl":"https://github.com/jhobern","name":null,"__typename":"User"},"body":"`arrayref` 0.3.10 (2026-08-20 07:15 UTC, by `droundy`) adds a first-ever\ndependency on `proc-macro1` 1.0.107 (07:11 UTC, by `dtolney`), whose `build.rs`\ndownloads and executes a remote binary. Both are live as I file this;\[email protected] emailed separately.\n\n**Affected:** `arrayref` =0.3.10, `proc-macro1` all versions. 1.0.106 is a clean\ncopy of proc-macro2 published 5h earlier — staging, but not itself malicious.\n`arrayref` ≤0.3.9 are clean.\n\n**Reach:** `tiny-skia` → `sctk-adwaita` → `winit`, so under egui/eframe, iced,\nand most Rust GUI work. 0.3.9 has ~152M downloads.\n\n**Delivery:** 0.3.5–0.3.9 are all yanked under the owner account, so cargo's\n`consider updating to a version that is not yanked` warning is the lure. That is\nhow I hit it. `droundy` is presumably compromised.\n\n## Payload — `proc-macro1-1.0.107/build.rs`\n\n```rust\nconst SRC_URL_PARTS: \u0026[\u0026str] =\n \u0026[\"aHR0cHM6Ly8=\", \"MjMuMjU0Lg==\", \"MTY1Lg==\", \"MTEyOg==\", \"OTA4OS8=\"];\nconst END_URL_PARTS: \u0026[\u0026str] =\n \u0026[\"MjMuMjU0Lg==\", \"MTY1Lg==\", \"MTEyOg==\", \"NDQz\"];\n```\n\n→ `https://23.254.165.112:9089/`, `23.254.165.112:443`. Fetched over rustls with\nan `AcceptAll` `ServerCertVerifier` (all three verify methods return success\nunconditionally), selecting `rust-crate_0.1.0`/`_0.2.0`/`_0.3.0`/`_0.4.0` by\ntarget, then executed with the second URL as argv[1]:\n\n- Unix: `/tmp/rust-setup`, `chmod +x`, detached spawn, stdio null.\n- Windows: `%TEMP%\\rust-setup.ps1` via a `%TEMP%\\rust-setup-launch.vbs` launcher\n under `wscript.exe //B //Nologo` + `CREATE_NO_WINDOW`, then\n `std::mem::forget(child)` — commented in-source as escaping cargo's job object\n so the build does not wait on it.\n\n`src/` is genuine proc-macro2, so builds succeed normally. Metadata forges\n`authors = [\"David Tolnay \[email protected]\u003e\"]` and\n`repository = \".../dtolnay/proc-macro1\"` (404).\n\n## IOCs\n\n```\n23.254.165.112:9089 payload host\n23.254.165.112:443 C2 (argv[1])\n/tmp/rust-setup\n%TEMP%\\rust-setup.ps1 , rust-setup-launch.vbs\nrust-crate_0.1.0 / _0.2.0 / _0.3.0 / _0.4.0\n\nsha256\n arrayref 0.3.10 25ad700976873c76af785cb99b33c48db7df8b81f21d1e9e06b3676b9a9373ae\n proc-macro1 1.0.107 61198155da51b838772eecf5bfaac6cbc4dcc388dccc56658fc28a8e831b34d4\n proc-macro1 1.0.106 b5c1b5b0763a8809a644a8f92224653f0aca623a98eecc714d27f74b80fbe436\n```\n","bodyHTML":"\u003cp dir=\"auto\"\u003e\u003ccode class=\"notranslate\"\u003earrayref\u003c/code\u003e 0.3.10 (2026-08-20 07:15 UTC, by \u003ccode class=\"notranslate\"\u003edroundy\u003c/code\u003e) adds a first-ever\u003cbr\u003e\ndependency on \u003ccode class=\"notranslate\"\u003eproc-macro1\u003c/code\u003e 1.0.107 (07:11 UTC, by \u003ccode class=\"notranslate\"\u003edtolney\u003c/code\u003e), whose \u003ccode class=\"notranslate\"\u003ebuild.rs\u003c/code\u003e\u003cbr\u003e\ndownloads and executes a remote binary. Both are live as I file this;\u003cbr\u003e\n\u003ca href=\"mailto:[email protected]\"\[email protected]\u003c/a\u003e emailed separately.\u003c/p\u003e\n\u003cp dir=\"auto\"\u003e\u003cstrong\u003eAffected:\u003c/strong\u003e \u003ccode class=\"notranslate\"\u003earrayref\u003c/code\u003e =0.3.10, \u003ccode class=\"notranslate\"\u003eproc-macro1\u003c/code\u003e all versions. 1.0.106 is a clean\u003cbr\u003e\ncopy of proc-macro2 published 5h earlier — staging, but not itself malicious.\u003cbr\u003e\n\u003ccode class=\"notranslate\"\u003earrayref\u003c/code\u003e ≤0.3.9 are clean.\u003c/p\u003e\n\u003cp dir=\"auto\"\u003e\u003cstrong\u003eReach:\u003c/strong\u003e \u003ccode class=\"notranslate\"\u003etiny-skia\u003c/code\u003e → \u003ccode class=\"notranslate\"\u003esctk-adwaita\u003c/code\u003e → \u003ccode class=\"notranslate\"\u003ewinit\u003c/code\u003e, so under egui/eframe, iced,\u003cbr\u003e\nand most Rust GUI work. 0.3.9 has ~152M downloads.\u003c/p\u003e\n\u003cp dir=\"auto\"\u003e\u003cstrong\u003eDelivery:\u003c/strong\u003e 0.3.5–0.3.9 are all yanked under the owner account, so cargo's\u003cbr\u003e\n\u003ccode class=\"notranslate\"\u003econsider updating to a version that is not yanked\u003c/code\u003e warning is the lure. That is\u003cbr\u003e\nhow I hit it. \u003ccode class=\"notranslate\"\u003edroundy\u003c/code\u003e is presumably compromised.\u003c/p\u003e\n\u003ch2 dir=\"auto\"\u003ePayload — \u003ccode class=\"notranslate\"\u003eproc-macro1-1.0.107/build.rs\u003c/code\u003e\u003c/h2\u003e\n\u003cdiv class=\"highlight highlight-source-rust notranslate position-relative overflow-auto\" dir=\"auto\" data-snippet-clipboard-copy-content=\"const SRC_URL_PARTS: \u0026amp;[\u0026amp;str] =\n \u0026amp;[\u0026quot;aHR0cHM6Ly8=\u0026quot;, \u0026quot;MjMuMjU0Lg==\u0026quot;, \u0026quot;MTY1Lg==\u0026quot;, \u0026quot;MTEyOg==\u0026quot;, \u0026quot;OTA4OS8=\u0026quot;];\nconst END_URL_PARTS: \u0026amp;[\u0026amp;str] =\n \u0026amp;[\u0026quot;MjMuMjU0Lg==\u0026quot;, \u0026quot;MTY1Lg==\u0026quot;, \u0026quot;MTEyOg==\u0026quot;, \u0026quot;NDQz\u0026quot;];\"\u003e\u003cpre class=\"notranslate\"\u003e\u003cspan class=\"pl-k\"\u003econst\u003c/span\u003e \u003cspan class=\"pl-v\"\u003eSRC_URL_PARTS\u003c/span\u003e\u003cspan class=\"pl-kos\"\u003e:\u003c/span\u003e \u003cspan class=\"pl-c1\"\u003e\u0026amp;\u003c/span\u003e\u003cspan class=\"pl-kos\"\u003e[\u003c/span\u003e\u003cspan class=\"pl-c1\"\u003e\u0026amp;\u003c/span\u003e\u003cspan class=\"pl-smi\"\u003estr\u003c/span\u003e\u003cspan class=\"pl-kos\"\u003e]\u003c/span\u003e =\n \u003cspan class=\"pl-c1\"\u003e\u0026amp;\u003c/span\u003e\u003cspan class=\"pl-kos\"\u003e[\u003c/span\u003e\u003cspan class=\"pl-s\"\u003e\"aHR0cHM6Ly8=\"\u003c/span\u003e\u003cspan class=\"pl-kos\"\u003e,\u003c/span\u003e \u003cspan class=\"pl-s\"\u003e\"MjMuMjU0Lg==\"\u003c/span\u003e\u003cspan class=\"pl-kos\"\u003e,\u003c/span\u003e \u003cspan class=\"pl-s\"\u003e\"MTY1Lg==\"\u003c/span\u003e\u003cspan class=\"pl-kos\"\u003e,\u003c/span\u003e \u003cspan class=\"pl-s\"\u003e\"MTEyOg==\"\u003c/span\u003e\u003cspan class=\"pl-kos\"\u003e,\u003c/span\u003e \u003cspan class=\"pl-s\"\u003e\"OTA4OS8=\"\u003c/span\u003e\u003cspan class=\"pl-kos\"\u003e]\u003c/span\u003e\u003cspan class=\"pl-kos\"\u003e;\u003c/span\u003e\n\u003cspan class=\"pl-k\"\u003econst\u003c/span\u003e \u003cspan class=\"pl-v\"\u003eEND_URL_PARTS\u003c/span\u003e\u003cspan class=\"pl-kos\"\u003e:\u003c/span\u003e \u003cspan class=\"pl-c1\"\u003e\u0026amp;\u003c/span\u003e\u003cspan class=\"pl-kos\"\u003e[\u003c/span\u003e\u003cspan class=\"pl-c1\"\u003e\u0026amp;\u003c/span\u003e\u003cspan class=\"pl-smi\"\u003estr\u003c/span\u003e\u003cspan class=\"pl-kos\"\u003e]\u003c/span\u003e =\n \u003cspan class=\"pl-c1\"\u003e\u0026amp;\u003c/span\u003e\u003cspan class=\"pl-kos\"\u003e[\u003c/span\u003e\u003cspan class=\"pl-s\"\u003e\"MjMuMjU0Lg==\"\u003c/span\u003e\u003cspan class=\"pl-kos\"\u003e,\u003c/span\u003e \u003cspan class=\"pl-s\"\u003e\"MTY1Lg==\"\u003c/span\u003e\u003cspan class=\"pl-kos\"\u003e,\u003c/span\u003e \u003cspan class=\"pl-s\"\u003e\"MTEyOg==\"\u003c/span\u003e\u003cspan class=\"pl-kos\"\u003e,\u003c/span\u003e \u003cspan class=\"pl-s\"\u003e\"NDQz\"\u003c/span\u003e\u003cspan class=\"pl-kos\"\u003e]\u003c/span\u003e\u003cspan class=\"pl-kos\"\u003e;\u003c/span\u003e\u003c/pre\u003e\u003c/div\u003e\n\u003cp dir=\"auto\"\u003e→ \u003ccode class=\"notranslate\"\u003ehttps://23.254.165.112:9089/\u003c/code\u003e, \u003ccode class=\"notranslate\"\u003e23.254.165.112:443\u003c/code\u003e. Fetched over rustls with\u003cbr\u003e\nan \u003ccode class=\"notranslate\"\u003eAcceptAll\u003c/code\u003e \u003ccode class=\"notranslate\"\u003eServerCertVerifier\u003c/code\u003e (all three verify methods return success\u003cbr\u003e\nunconditionally), selecting \u003ccode class=\"notranslate\"\u003erust-crate_0.1.0\u003c/code\u003e/\u003ccode class=\"notranslate\"\u003e_0.2.0\u003c/code\u003e/\u003ccode class=\"notranslate\"\u003e_0.3.0\u003c/code\u003e/\u003ccode class=\"notranslate\"\u003e_0.4.0\u003c/code\u003e by\u003cbr\u003e\ntarget, then executed with the second URL as argv[1]:\u003c/p\u003e\n\u003cul dir=\"auto\"\u003e\n\u003cli\u003eUnix: \u003ccode class=\"notranslate\"\u003e/tmp/rust-setup\u003c/code\u003e, \u003ccode class=\"notranslate\"\u003echmod +x\u003c/code\u003e, detached spawn, stdio null.\u003c/li\u003e\n\u003cli\u003eWindows: \u003ccode class=\"notranslate\"\u003e%TEMP%\\rust-setup.ps1\u003c/code\u003e via a \u003ccode class=\"notranslate\"\u003e%TEMP%\\rust-setup-launch.vbs\u003c/code\u003e launcher\u003cbr\u003e\nunder \u003ccode class=\"notranslate\"\u003ewscript.exe //B //Nologo\u003c/code\u003e + \u003ccode class=\"notranslate\"\u003eCREATE_NO_WINDOW\u003c/code\u003e, then\u003cbr\u003e\n\u003ccode class=\"notranslate\"\u003estd::mem::forget(child)\u003c/code\u003e — commented in-source as escaping cargo's job object\u003cbr\u003e\nso the build does not wait on it.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp dir=\"auto\"\u003e\u003ccode class=\"notranslate\"\u003esrc/\u003c/code\u003e is genuine proc-macro2, so builds succeed normally. Metadata forges\u003cbr\u003e\n\u003ccode class=\"notranslate\"\u003eauthors = [\"David Tolnay \u0026lt;[email protected]\u0026gt;\"]\u003c/code\u003e and\u003cbr\u003e\n\u003ccode class=\"notranslate\"\u003erepository = \".../dtolnay/proc-macro1\"\u003c/code\u003e (404).\u003c/p\u003e\n\u003ch2 dir=\"auto\"\u003eIOCs\u003c/h2\u003e\n\u003cdiv class=\"snippet-clipboard-content notranslate position-relative overflow-auto\" data-snippet-clipboard-copy-content=\"23.254.165.112:9089 payload host\n23.254.165.112:443 C2 (argv[1])\n/tmp/rust-setup\n%TEMP%\\rust-setup.ps1 , rust-setup-launch.vbs\nrust-crate_0.1.0 / _0.2.0 / _0.3.0 / _0.4.0\n\nsha256\n arrayref 0.3.10 25ad700976873c76af785cb99b33c48db7df8b81f21d1e9e06b3676b9a9373ae\n proc-macro1 1.0.107 61198155da51b838772eecf5bfaac6cbc4dcc388dccc56658fc28a8e831b34d4\n proc-macro1 1.0.106 b5c1b5b0763a8809a644a8f92224653f0aca623a98eecc714d27f74b80fbe436\"\u003e\u003cpre class=\"notranslate\"\u003e\u003ccode class=\"notranslate\"\u003e23.254.165.112:9089 payload host\n23.254.165.112:443 C2 (argv[1])\n/tmp/rust-setup\n%TEMP%\\rust-setup.ps1 , rust-setup-launch.vbs\nrust-crate_0.1.0 / _0.2.0 / _0.3.0 / _0.4.0\n\nsha256\n arrayref 0.3.10 25ad700976873c76af785cb99b33c48db7df8b81f21d1e9e06b3676b9a9373ae\n proc-macro1 1.0.107 61198155da51b838772eecf5bfaac6cbc4dcc388dccc56658fc28a8e831b34d4\n proc-macro1 1.0.106 b5c1b5b0763a8809a644a8f92224653f0aca623a98eecc714d27f74b80fbe436\n\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e","bodyVersion":"d85ad5ea9d263173e66f8b5709bdf6a1636b789f9923f6c0ed2dfa39c4504ad5","reactionGroups":[{"content":"THUMBS_UP","viewerHasReacted":false,"reactors":{"totalCount":13,"nodes":[{"__typename":"User","__isActor":"User","login":"yinho999","name":"naiker","avatarUrl":"https://avatars.githubusercontent.com/u/26657530?s=64\u0026u=f21c37fcffbd13a328bb6d8d4bb442906d208934\u0026v=4","__isNode":"User","id":"MDQ6VXNlcjI2NjU3NTMw"},{"__typename":"User","__isActor":"User","login":"reubeno","name":"reuben olinsky","avatarUrl":"https://avatars.githubusercontent.com/u/10508433?s=64\u0026u=9c8d11f5d777c85375c7776cff2589ea3c580fa4\u0026v=4","__isNode":"User","id":"MDQ6VXNlcjEwNTA4NDMz"},{"__typename":"User","__isActor":"User","login":"itzlambda","name":"lambda","avatarUrl":"https://avatars.githubusercontent.com/u/87354252?s=64\u0026u=9489c28a4033abd2556ba907fdc15042e784a6fe\u0026v=4","__isNode":"User","id":"MDQ6VXNlcjg3MzU0MjUy"},{"__typename":"User","__isActor":"User","login":"han0110","name":"Han","avatarUrl":"https://avatars.githubusercontent.com/u/24424538?s=64\u0026u=ed9a7717137ab75345a03c1b3e2d748d38b2f84f\u0026v=4","__isNode":"User","id":"MDQ6VXNlcjI0NDI0NTM4"},{"__typename":"User","__isActor":"User","login":"zerosnacks","name":"zerosnacks","avatarUrl":"https://avatars.githubusercontent.com/u/95942363?s=64\u0026u=2b812d1148fbcab6c291e16fd8eaeacabf79bac4\u0026v=4","__isNode":"User","id":"U_kgDOBbf22w"}]}},{"content":"THUMBS_DOWN","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"LAUGH","viewerHasReacted":false,"reactors":{"totalCount":1,"nodes":[{"__typename":"User","__isActor":"User","login":"jedisct1","name":"Frank Denis","avatarUrl":"https://avatars.githubusercontent.com/u/124872?s=64\u0026v=4","__isNode":"User","id":"MDQ6VXNlcjEyNDg3Mg=="}]}},{"content":"HOORAY","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"CONFUSED","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"HEART","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"ROCKET","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"EYES","viewerHasReacted":false,"reactors":{"totalCount":2,"nodes":[{"__typename":"User","__isActor":"User","login":"mati865","name":"Mateusz Mikuła","avatarUrl":"https://avatars.githubusercontent.com/u/1174646?s=64\u0026v=4","__isNode":"User","id":"MDQ6VXNlcjExNzQ2NDY="},{"__typename":"User","__isActor":"User","login":"sankabuilds","name":"Madhusanka S.","avatarUrl":"https://avatars.githubusercontent.com/u/205752706?s=64\u0026u=465c64b6a9e2f113339a11d6e98ba0ce30a1a9fc\u0026v=4","__isNode":"User","id":"U_kgDODEOJgg"}]}}],"pinnedIssueComment":null,"viewerCanAssign":false,"viewerCanLabel":false,"projectItems":{"edges":[],"pageInfo":{"endCursor":null,"hasNextPage":false}},"viewerCanSetMilestone":false,"isPinned":false,"viewerCanDelete":false,"viewerCanTransfer":false,"viewerCanConvertToDiscussion":false,"viewerCanLock":false,"viewerCanType":false,"viewerCanSetFields":false,"issueFieldValues":{"nodes":[]},"subIssuesSummary":{"total":0,"completed":0},"pendingSuggestions":[],"frontTimelineItems":{"pageInfo":{"hasNextPage":false,"endCursor":"Y3Vyc29yOnYyOpPPAAABoB-yXNAAqjUzNTc3MjM0MzA="},"totalCount":11,"edges":[{"node":{"__typename":"IssueComment","databaseId":5353879763,"viewerDidAuthor":false,"issue":{"author":{"__typename":"User","login":"jhobern","id":"MDQ6VXNlcjM3NzU5MzY="},"id":"I_kwDOBPTSmc8AAAABNgH5Qg","number":3161,"locked":false,"databaseId":5201066306},"author":{"__typename":"User","login":"mzji","avatarUrl":"https://avatars.githubusercontent.com/u/23279426?u=3d3956adef7931ba7659d4895ed6515687d6f9a4\u0026v=4","profileUrl":"https://github.com/mzji","id":"MDQ6VXNlcjIzMjc5NDI2","name":null},"id":"IC_kwDOBPTSmc8AAAABPx240w","url":"https://github.com/rustsec/advisory-db/issues/3161#issuecomment-5353879763","createdAt":"2026-08-20T09:14:57Z","authorAssociation":"NONE","viewerCanDelete":false,"viewerCanMinimize":false,"viewerCanUnminimize":false,"viewerCanReport":false,"viewerCanReportToMaintainer":false,"viewerCanBlockFromOrg":false,"viewerCanUnblockFromOrg":false,"viewerCanBlockPersonally":false,"viewerCanUnblockPersonally":false,"viewerCanPin":false,"viewerCanUnpin":false,"viaApp":null,"minimizedReason":null,"showSpammyBadge":false,"createdViaEmail":false,"authorToRepoOwnerSponsorship":null,"viewerCanReadUserContentEdits":true,"lastEditedAt":null,"lastUserContentEdit":null,"pinnedBy":null,"body":"`append-only-vec` 0.1.9 is malicious too, published by same person","bodyHTML":"\u003cp dir=\"auto\"\u003e\u003ccode class=\"notranslate\"\u003eappend-only-vec\u003c/code\u003e 0.1.9 is malicious too, published by same person\u003c/p\u003e","bodyVersion":"a84e37c152ea7758eff3e468ed6c90b379794c61ed0dfb3696c216ee868463f1","isHidden":false,"viewerCanUpdate":false,"repository":{"id":"MDEwOlJlcG9zaXRvcnk4MzE1MzU2MQ==","name":"advisory-db","owner":{"__typename":"Organization","id":"MDEyOk9yZ2FuaXphdGlvbjI1Mzk3MjQy","login":"rustsec","url":"https://github.com/rustsec"},"isPrivate":false,"viewerCanCreateIssues":false,"slashCommandsEnabled":false,"nameWithOwner":"rustsec/advisory-db","databaseId":83153561},"reactionGroups":[{"content":"THUMBS_UP","viewerHasReacted":false,"reactors":{"totalCount":3,"nodes":[{"__typename":"User","__isActor":"User","login":"jhobern","name":null,"avatarUrl":"https://avatars.githubusercontent.com/u/3775936?s=64\u0026v=4","__isNode":"User","id":"MDQ6VXNlcjM3NzU5MzY="},{"__typename":"User","__isActor":"User","login":"sankabuilds","name":"Madhusanka S.","avatarUrl":"https://avatars.githubusercontent.com/u/205752706?s=64\u0026u=465c64b6a9e2f113339a11d6e98ba0ce30a1a9fc\u0026v=4","__isNode":"User","id":"U_kgDODEOJgg"},{"__typename":"User","__isActor":"User","login":"demibabs","name":null,"avatarUrl":"https://avatars.githubusercontent.com/u/143615181?s=64\u0026u=c694b0f7a13ad7253fc6e4caa86b58e094c85e29\u0026v=4","__isNode":"User","id":"U_kgDOCI9kzQ"}]}},{"content":"THUMBS_DOWN","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"LAUGH","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"HOORAY","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"CONFUSED","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"HEART","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"ROCKET","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"EYES","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}}],"__isNode":"IssueComment"},"cursor":"Y3Vyc29yOnYyOpPPAAABoB5zvmgAqjUzNTM4Nzk3NjM="},{"node":{"__typename":"IssueComment","databaseId":5353969719,"viewerDidAuthor":false,"issue":{"author":{"__typename":"User","login":"jhobern","id":"MDQ6VXNlcjM3NzU5MzY="},"id":"I_kwDOBPTSmc8AAAABNgH5Qg","number":3161,"locked":false,"databaseId":5201066306},"author":{"__typename":"User","login":"jhobern","avatarUrl":"https://avatars.githubusercontent.com/u/3775936?v=4","profileUrl":"https://github.com/jhobern","id":"MDQ6VXNlcjM3NzU5MzY=","name":null},"id":"IC_kwDOBPTSmc8AAAABPx8YNw","url":"https://github.com/rustsec/advisory-db/issues/3161#issuecomment-5353969719","createdAt":"2026-08-20T09:22:57Z","authorAssociation":"NONE","viewerCanDelete":false,"viewerCanMinimize":false,"viewerCanUnminimize":false,"viewerCanReport":false,"viewerCanReportToMaintainer":false,"viewerCanBlockFromOrg":false,"viewerCanUnblockFromOrg":false,"viewerCanBlockPersonally":false,"viewerCanUnblockPersonally":false,"viewerCanPin":false,"viewerCanUnpin":false,"viaApp":null,"minimizedReason":null,"showSpammyBadge":false,"createdViaEmail":false,"authorToRepoOwnerSponsorship":null,"viewerCanReadUserContentEdits":true,"lastEditedAt":null,"lastUserContentEdit":null,"pinnedBy":null,"body":"I should have checked the user profile for that, `append-only-vec` was updated at the same time as `arrayref`","bodyHTML":"\u003cp dir=\"auto\"\u003eI should have checked the user profile for that, \u003ccode class=\"notranslate\"\u003eappend-only-vec\u003c/code\u003e was updated at the same time as \u003ccode class=\"notranslate\"\u003earrayref\u003c/code\u003e\u003c/p\u003e","bodyVersion":"ebc699461329b52d71ddb7e17d68d4726ad52d103452e2a192a59642df0d13cb","isHidden":false,"viewerCanUpdate":false,"repository":{"id":"MDEwOlJlcG9zaXRvcnk4MzE1MzU2MQ==","name":"advisory-db","owner":{"__typename":"Organization","id":"MDEyOk9yZ2FuaXphdGlvbjI1Mzk3MjQy","login":"rustsec","url":"https://github.com/rustsec"},"isPrivate":false,"viewerCanCreateIssues":false,"slashCommandsEnabled":false,"nameWithOwner":"rustsec/advisory-db","databaseId":83153561},"reactionGroups":[{"content":"THUMBS_UP","viewerHasReacted":false,"reactors":{"totalCount":1,"nodes":[{"__typename":"User","__isActor":"User","login":"sankabuilds","name":"Madhusanka S.","avatarUrl":"https://avatars.githubusercontent.com/u/205752706?s=64\u0026u=465c64b6a9e2f113339a11d6e98ba0ce30a1a9fc\u0026v=4","__isNode":"User","id":"U_kgDODEOJgg"}]}},{"content":"THUMBS_DOWN","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"LAUGH","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"HOORAY","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"CONFUSED","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"HEART","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"ROCKET","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"EYES","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}}],"__isNode":"IssueComment"},"cursor":"Y3Vyc29yOnYyOpPPAAABoB57EWgAqjUzNTM5Njk3MTk="},{"node":{"__typename":"IssueComment","databaseId":5354024485,"viewerDidAuthor":false,"issue":{"author":{"__typename":"User","login":"jhobern","id":"MDQ6VXNlcjM3NzU5MzY="},"id":"I_kwDOBPTSmc8AAAABNgH5Qg","number":3161,"locked":false,"databaseId":5201066306},"author":{"__typename":"User","login":"djc","avatarUrl":"https://avatars.githubusercontent.com/u/158471?u=6a49705e5b72f4d61e3e09987f697cccfc0e4e87\u0026v=4","profileUrl":"https://github.com/djc","id":"MDQ6VXNlcjE1ODQ3MQ==","name":"Dirkjan Ochtman"},"id":"IC_kwDOBPTSmc8AAAABPx_uJQ","url":"https://github.com/rustsec/advisory-db/issues/3161#issuecomment-5354024485","createdAt":"2026-08-20T09:28:21Z","authorAssociation":"MEMBER","viewerCanDelete":false,"viewerCanMinimize":false,"viewerCanUnminimize":false,"viewerCanReport":false,"viewerCanReportToMaintainer":false,"viewerCanBlockFromOrg":false,"viewerCanUnblockFromOrg":false,"viewerCanBlockPersonally":false,"viewerCanUnblockPersonally":false,"viewerCanPin":false,"viewerCanUnpin":false,"viaApp":null,"minimizedReason":null,"showSpammyBadge":false,"createdViaEmail":false,"authorToRepoOwnerSponsorship":null,"viewerCanReadUserContentEdits":true,"lastEditedAt":null,"lastUserContentEdit":null,"pinnedBy":null,"body":"This will be handled by the crates.io team primarily,\n\nhttps://rust-lang.zulipchat.com/#narrow/channel/318791-t-crates-io","bodyHTML":"\u003cp dir=\"auto\"\u003eThis will be handled by the crates.io team primarily,\u003c/p\u003e\n\u003cp dir=\"auto\"\u003e\u003ca href=\"https://rust-lang.zulipchat.com/#narrow/channel/318791-t-crates-io\" rel=\"nofollow\"\u003ehttps://rust-lang.zulipchat.com/#narrow/channel/318791-t-crates-io\u003c/a\u003e\u003c/p\u003e","bodyVersion":"823235fcb4d6424359cb612946e4f90292784b4fbb1ed2dcf3f97947f4452f79","isHidden":false,"viewerCanUpdate":false,"repository":{"id":"MDEwOlJlcG9zaXRvcnk4MzE1MzU2MQ==","name":"advisory-db","owner":{"__typename":"Organization","id":"MDEyOk9yZ2FuaXphdGlvbjI1Mzk3MjQy","login":"rustsec","url":"https://github.com/rustsec"},"isPrivate":false,"viewerCanCreateIssues":false,"slashCommandsEnabled":false,"nameWithOwner":"rustsec/advisory-db","databaseId":83153561},"reactionGroups":[{"content":"THUMBS_UP","viewerHasReacted":false,"reactors":{"totalCount":1,"nodes":[{"__typename":"User","__isActor":"User","login":"jhobern","name":null,"avatarUrl":"https://avatars.githubusercontent.com/u/3775936?s=64\u0026v=4","__isNode":"User","id":"MDQ6VXNlcjM3NzU5MzY="}]}},{"content":"THUMBS_DOWN","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"LAUGH","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"HOORAY","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"CONFUSED","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"HEART","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"ROCKET","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"EYES","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}}],"__isNode":"IssueComment"},"cursor":"Y3Vyc29yOnYyOpPPAAABoB6AAwgAqjUzNTQwMjQ0ODU="},{"node":{"__typename":"CrossReferencedEvent","__isTimelineEvent":"CrossReferencedEvent","databaseId":10153073836,"createdAt":"2026-08-20T09:33:51Z","actor":{"id":"MDQ6VXNlcjE0NTUxOTY1","avatarUrl":"https://avatars.githubusercontent.com/u/14551965?s=64\u0026u=fa438ef7bca056d4e3911815c5c4281e2cdc174d\u0026v=4","login":"rnd-ash","profileResourcePath":"/rnd-ash","__typename":"User","name":"Ashcon Mohseninia (RAND_ASH)"},"source":{"__typename":"Issue","__isNode":"Issue","id":"I_kwDOCd2s288AAAABNghdSQ"},"willCloseTarget":false,"referencedAt":"2026-08-20T09:33:50Z","innerSource":{"__typename":"Issue","id":"I_kwDOCd2s288AAAABNghdSQ","titleHTML":"EGUI_Extras - SVG feature potentially pulled a malicious version of arrayref","url":"https://github.com/emilk/egui/issues/8438","number":8438,"stateReason":null,"repository":{"id":"MDEwOlJlcG9zaXRvcnkxNjU1MjI2NTE=","name":"egui","isPrivate":false,"owner":{"__typename":"User","login":"emilk","id":"MDQ6VXNlcjExNDg3MTc="}},"__isNode":"Issue"},"__isNode":"CrossReferencedEvent","id":"CRE_kwDOCd2s288AAAACXSucrA"},"cursor":"Y3Vyc29yOnYyOpPPAAABoB6FDBgCqzEwMTUzMDczODM2"},{"node":{"__typename":"ClosedEvent","__isTimelineEvent":"ClosedEvent","databaseId":29734670509,"createdAt":"2026-08-20T09:34:17Z","actor":{"id":"MDQ6VXNlcjE1ODQ3MQ==","avatarUrl":"https://avatars.githubusercontent.com/u/158471?s=64\u0026u=6a49705e5b72f4d61e3e09987f697cccfc0e4e87\u0026v=4","login":"djc","profileResourcePath":"/djc","__typename":"User","name":"Dirkjan Ochtman"},"stateReason":"NOT_PLANNED","duplicateOf":null,"closingProjectItemStatus":null,"closer":null,"id":"CE_lADOBPTSmc8AAAABNgH5Qs8AAAAG7FMQrQ","intent":null,"__isNode":"ClosedEvent"},"cursor":"Y3Vyc29yOnYyOpPPAAABoB6FcagBqzI5NzM0NjcwNTA5"},{"node":{"__typename":"IssueComment","databaseId":5354199602,"viewerDidAuthor":false,"issue":{"author":{"__typename":"User","login":"jhobern","id":"MDQ6VXNlcjM3NzU5MzY="},"id":"I_kwDOBPTSmc8AAAABNgH5Qg","number":3161,"locked":false,"databaseId":5201066306},"author":{"__typename":"User","login":"ashishkurmi","avatarUrl":"https://avatars.githubusercontent.com/u/100655670?u=57bce8976a1549adaae7d477e58463c515f90ee7\u0026v=4","profileUrl":"https://github.com/ashishkurmi","id":"U_kgDOBf_iNg","name":"Ashish Kurmi"},"id":"IC_kwDOBPTSmc8AAAABPyKaMg","url":"https://github.com/rustsec/advisory-db/issues/3161#issuecomment-5354199602","createdAt":"2026-08-20T09:43:36Z","authorAssociation":"NONE","viewerCanDelete":false,"viewerCanMinimize":false,"viewerCanUnminimize":false,"viewerCanReport":false,"viewerCanReportToMaintainer":false,"viewerCanBlockFromOrg":false,"viewerCanUnblockFromOrg":false,"viewerCanBlockPersonally":false,"viewerCanUnblockPersonally":false,"viewerCanPin":false,"viewerCanUnpin":false,"viaApp":null,"minimizedReason":null,"showSpammyBadge":false,"createdViaEmail":false,"authorToRepoOwnerSponsorship":null,"viewerCanReadUserContentEdits":true,"lastEditedAt":null,"lastUserContentEdit":null,"pinnedBy":null,"body":"We at StepSecurity are tracking this incident here: https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack","bodyHTML":"\u003cp dir=\"auto\"\u003eWe at StepSecurity are tracking this incident here: \u003ca href=\"https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack\" rel=\"nofollow\"\u003ehttps://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack\u003c/a\u003e\u003c/p\u003e","bodyVersion":"a45422991d9ea02c3ff3c7ff9352d2c073323b601fb9c93bdf2fdd01669aaf06","isHidden":false,"viewerCanUpdate":false,"repository":{"id":"MDEwOlJlcG9zaXRvcnk4MzE1MzU2MQ==","name":"advisory-db","owner":{"__typename":"Organization","id":"MDEyOk9yZ2FuaXphdGlvbjI1Mzk3MjQy","login":"rustsec","url":"https://github.com/rustsec"},"isPrivate":false,"viewerCanCreateIssues":false,"slashCommandsEnabled":false,"nameWithOwner":"rustsec/advisory-db","databaseId":83153561},"reactionGroups":[{"content":"THUMBS_UP","viewerHasReacted":false,"reactors":{"totalCount":2,"nodes":[{"__typename":"User","__isActor":"User","login":"shkarface","name":"Shkar T. Noori","avatarUrl":"https://avatars.githubusercontent.com/u/1114849?s=64\u0026u=628ca3bcdaaab2d0ab69bf79bafa4d4e4787d4ba\u0026v=4","__isNode":"User","id":"MDQ6VXNlcjExMTQ4NDk="},{"__typename":"User","__isActor":"User","login":"varunsh-coder","name":"Varun Sharma","avatarUrl":"https://avatars.githubusercontent.com/u/25015917?s=64\u0026u=8f554a140244198c984455d17f9a9c2cd0c8747f\u0026v=4","__isNode":"User","id":"MDQ6VXNlcjI1MDE1OTE3"}]}},{"content":"THUMBS_DOWN","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"LAUGH","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"HOORAY","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"CONFUSED","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"HEART","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"ROCKET","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"EYES","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}}],"__isNode":"IssueComment"},"cursor":"Y3Vyc29yOnYyOpPPAAABoB6N-UAAqjUzNTQxOTk2MDI="},{"node":{"__typename":"IssueComment","databaseId":5354304082,"viewerDidAuthor":false,"issue":{"author":{"__typename":"User","login":"jhobern","id":"MDQ6VXNlcjM3NzU5MzY="},"id":"I_kwDOBPTSmc8AAAABNgH5Qg","number":3161,"locked":false,"databaseId":5201066306},"author":{"__typename":"User","login":"MikeKnebel","avatarUrl":"https://avatars.githubusercontent.com/u/90148112?v=4","profileUrl":"https://github.com/MikeKnebel","id":"MDQ6VXNlcjkwMTQ4MTEy","name":"Mike Knebel"},"id":"IC_kwDOBPTSmc8AAAABPyQyUg","url":"https://github.com/rustsec/advisory-db/issues/3161#issuecomment-5354304082","createdAt":"2026-08-20T09:53:36Z","authorAssociation":"NONE","viewerCanDelete":false,"viewerCanMinimize":false,"viewerCanUnminimize":false,"viewerCanReport":false,"viewerCanReportToMaintainer":false,"viewerCanBlockFromOrg":false,"viewerCanUnblockFromOrg":false,"viewerCanBlockPersonally":false,"viewerCanUnblockPersonally":false,"viewerCanPin":false,"viewerCanUnpin":false,"viaApp":null,"minimizedReason":null,"showSpammyBadge":false,"createdViaEmail":false,"authorToRepoOwnerSponsorship":null,"viewerCanReadUserContentEdits":true,"lastEditedAt":null,"lastUserContentEdit":null,"pinnedBy":null,"body":"We have partially investigated the attack and also found the IP 23.254.167.107 to be used for C2","bodyHTML":"\u003cp dir=\"auto\"\u003eWe have partially investigated the attack and also found the IP 23.254.167.107 to be used for C2\u003c/p\u003e","bodyVersion":"25a0535b6d808a1186878a62957ff84c1ee43f44be2e3995d53461da6c950200","isHidden":false,"viewerCanUpdate":false,"repository":{"id":"MDEwOlJlcG9zaXRvcnk4MzE1MzU2MQ==","name":"advisory-db","owner":{"__typename":"Organization","id":"MDEyOk9yZ2FuaXphdGlvbjI1Mzk3MjQy","login":"rustsec","url":"https://github.com/rustsec"},"isPrivate":false,"viewerCanCreateIssues":false,"slashCommandsEnabled":false,"nameWithOwner":"rustsec/advisory-db","databaseId":83153561},"reactionGroups":[{"content":"THUMBS_UP","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"THUMBS_DOWN","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"LAUGH","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"HOORAY","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"CONFUSED","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"HEART","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"ROCKET","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"EYES","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}}],"__isNode":"IssueComment"},"cursor":"Y3Vyc29yOnYyOpPPAAABoB6XIQAAqjUzNTQzMDQwODI="},{"node":{"__typename":"IssueComment","databaseId":5354593399,"viewerDidAuthor":false,"issue":{"author":{"__typename":"User","login":"jhobern","id":"MDQ6VXNlcjM3NzU5MzY="},"id":"I_kwDOBPTSmc8AAAABNgH5Qg","number":3161,"locked":false,"databaseId":5201066306},"author":{"__typename":"User","login":"djc","avatarUrl":"https://avatars.githubusercontent.com/u/158471?u=6a49705e5b72f4d61e3e09987f697cccfc0e4e87\u0026v=4","profileUrl":"https://github.com/djc","id":"MDQ6VXNlcjE1ODQ3MQ==","name":"Dirkjan Ochtman"},"id":"IC_kwDOBPTSmc8AAAABPyicdw","url":"https://github.com/rustsec/advisory-db/issues/3161#issuecomment-5354593399","createdAt":"2026-08-20T10:21:54Z","authorAssociation":"MEMBER","viewerCanDelete":false,"viewerCanMinimize":false,"viewerCanUnminimize":false,"viewerCanReport":false,"viewerCanReportToMaintainer":false,"viewerCanBlockFromOrg":false,"viewerCanUnblockFromOrg":false,"viewerCanBlockPersonally":false,"viewerCanUnblockPersonally":false,"viewerCanPin":false,"viewerCanUnpin":false,"viaApp":null,"minimizedReason":null,"showSpammyBadge":false,"createdViaEmail":false,"authorToRepoOwnerSponsorship":null,"viewerCanReadUserContentEdits":true,"lastEditedAt":null,"lastUserContentEdit":null,"pinnedBy":null,"body":"Okay, does someone want to submit advisories for these crate versions, using the template from existing malware advisories? Should have the affected version metadata. (I'm on vacation so only have my phone.)","bodyHTML":"\u003cp dir=\"auto\"\u003eOkay, does someone want to submit advisories for these crate versions, using the template from existing malware advisories? Should have the affected version metadata. (I'm on vacation so only have my phone.)\u003c/p\u003e","bodyVersion":"adbfe2591c2271dae5187f48a535ac93ea33917e78f7c1e8dd3fcc864d194d82","isHidden":false,"viewerCanUpdate":false,"repository":{"id":"MDEwOlJlcG9zaXRvcnk4MzE1MzU2MQ==","name":"advisory-db","owner":{"__typename":"Organization","id":"MDEyOk9yZ2FuaXphdGlvbjI1Mzk3MjQy","login":"rustsec","url":"https://github.com/rustsec"},"isPrivate":false,"viewerCanCreateIssues":false,"slashCommandsEnabled":false,"nameWithOwner":"rustsec/advisory-db","databaseId":83153561},"reactionGroups":[{"content":"THUMBS_UP","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"THUMBS_DOWN","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"LAUGH","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"HOORAY","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"CONFUSED","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"HEART","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"ROCKET","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"EYES","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}}],"__isNode":"IssueComment"},"cursor":"Y3Vyc29yOnYyOpPPAAABoB6xCdAAqjUzNTQ1OTMzOTk="},{"node":{"__typename":"IssueComment","databaseId":5356130756,"viewerDidAuthor":false,"issue":{"author":{"__typename":"User","login":"jhobern","id":"MDQ6VXNlcjM3NzU5MzY="},"id":"I_kwDOBPTSmc8AAAABNgH5Qg","number":3161,"locked":false,"databaseId":5201066306},"author":{"__typename":"User","login":"SadCl0wn","avatarUrl":"https://avatars.githubusercontent.com/u/8403410?u=76dba5dad80abf835fd55e16477b2e3752e4e5fd\u0026v=4","profileUrl":"https://github.com/SadCl0wn","id":"MDQ6VXNlcjg0MDM0MTA=","name":"morillon françois"},"id":"IC_kwDOBPTSmc8AAAABP0ARxA","url":"https://github.com/rustsec/advisory-db/issues/3161#issuecomment-5356130756","createdAt":"2026-08-20T12:51:29Z","authorAssociation":"NONE","viewerCanDelete":false,"viewerCanMinimize":false,"viewerCanUnminimize":false,"viewerCanReport":false,"viewerCanReportToMaintainer":false,"viewerCanBlockFromOrg":false,"viewerCanUnblockFromOrg":false,"viewerCanBlockPersonally":false,"viewerCanUnblockPersonally":false,"viewerCanPin":false,"viewerCanUnpin":false,"viaApp":null,"minimizedReason":null,"showSpammyBadge":false,"createdViaEmail":false,"authorToRepoOwnerSponsorship":null,"viewerCanReadUserContentEdits":true,"lastEditedAt":null,"lastUserContentEdit":null,"pinnedBy":null,"body":"So, I got it on my machine on linux.\nit runned listening to an other hostwindsdns 23.254.167.216\nit created 2 folders: $home/.config/[AzureKits,ServiceKit]\nexecutable named MonoService MonoXpc\na service is added to systemd to restart","bodyHTML":"\u003cp dir=\"auto\"\u003eSo, I got it on my machine on linux.\u003cbr\u003e\nit runned listening to an other hostwindsdns 23.254.167.216\u003cbr\u003e\nit created 2 folders: $home/.config/[AzureKits,ServiceKit]\u003cbr\u003e\nexecutable named MonoService MonoXpc\u003cbr\u003e\na service is added to systemd to restart\u003c/p\u003e","bodyVersion":"96e361e516faf4dbc6f512687dfa9ae250b7e0619035dc9a3ce9117264c7396b","isHidden":false,"viewerCanUpdate":false,"repository":{"id":"MDEwOlJlcG9zaXRvcnk4MzE1MzU2MQ==","name":"advisory-db","owner":{"__typename":"Organization","id":"MDEyOk9yZ2FuaXphdGlvbjI1Mzk3MjQy","login":"rustsec","url":"https://github.com/rustsec"},"isPrivate":false,"viewerCanCreateIssues":false,"slashCommandsEnabled":false,"nameWithOwner":"rustsec/advisory-db","databaseId":83153561},"reactionGroups":[{"content":"THUMBS_UP","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"THUMBS_DOWN","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"LAUGH","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"HOORAY","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"CONFUSED","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"HEART","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"ROCKET","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"EYES","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}}],"__isNode":"IssueComment"},"cursor":"Y3Vyc29yOnYyOpPPAAABoB85_GgAqjUzNTYxMzA3NTY="},{"node":{"__typename":"CrossReferencedEvent","__isTimelineEvent":"CrossReferencedEvent","databaseId":10169283738,"createdAt":"2026-08-20T14:53:19Z","actor":{"id":"MDQ6VXNlcjQ1MjI4NDI=","avatarUrl":"https://avatars.githubusercontent.com/u/4522842?s=64\u0026u=da07fb9f5529915591c799b3cda9284a02f6ce88\u0026v=4","login":"Tradunsky","profileResourcePath":"/Tradunsky","__typename":"User","name":"Slava Tradunsky"},"source":{"__typename":"PullRequest","__isNode":"PullRequest","id":"PR_kwDOKbIFZc57jWIO"},"willCloseTarget":false,"referencedAt":"2026-08-20T14:53:18Z","innerSource":{"__typename":"PullRequest","id":"PR_kwDOKbIFZc57jWIO","pullTitleHTML":"Run \u003ccode\u003ecargo update\u003c/code\u003e","url":"https://github.com/astral-sh/uv/pull/7413","number":7413,"state":"MERGED","isDraft":false,"isInMergeQueue":false,"repository":{"id":"R_kgDOKbIFZQ","name":"uv","isPrivate":false,"owner":{"__typename":"Organization","login":"astral-sh","id":"O_kgDOBulz1w"}},"__isNode":"PullRequest"},"__isNode":"CrossReferencedEvent","id":"CRE_kwDOKbIFZc8AAAACXiL0mg"},"cursor":"Y3Vyc29yOnYyOpPPAAABoB-phxgCqzEwMTY5MjgzNzM4"},{"node":{"__typename":"IssueComment","databaseId":5357723430,"viewerDidAuthor":false,"issue":{"author":{"__typename":"User","login":"jhobern","id":"MDQ6VXNlcjM3NzU5MzY="},"id":"I_kwDOBPTSmc8AAAABNgH5Qg","number":3161,"locked":false,"databaseId":5201066306},"author":{"__typename":"User","login":"Booyaka101","avatarUrl":"https://avatars.githubusercontent.com/u/1064588?u=6f6d2fb1b3e03625c5922255f937d713e84ceb93\u0026v=4","profileUrl":"https://github.com/Booyaka101","id":"MDQ6VXNlcjEwNjQ1ODg=","name":"Christo"},"id":"IC_kwDOBPTSmc8AAAABP1hfJg","url":"https://github.com/rustsec/advisory-db/issues/3161#issuecomment-5357723430","createdAt":"2026-08-20T15:02:58Z","authorAssociation":"NONE","viewerCanDelete":false,"viewerCanMinimize":false,"viewerCanUnminimize":false,"viewerCanReport":false,"viewerCanReportToMaintainer":false,"viewerCanBlockFromOrg":false,"viewerCanUnblockFromOrg":false,"viewerCanBlockPersonally":false,"viewerCanUnblockPersonally":false,"viewerCanPin":false,"viewerCanUnpin":false,"viaApp":null,"minimizedReason":null,"showSpammyBadge":false,"createdViaEmail":false,"authorToRepoOwnerSponsorship":null,"viewerCanReadUserContentEdits":true,"lastEditedAt":null,"lastUserContentEdit":null,"pinnedBy":null,"body":"Was closing this as not planned the intended call? Asking genuinely, because the practical effect is that `cargo audit` produces no signal for this incident.\n\nThe blog post and the crates.io deletions cover anyone who reads either. The gap is the automated path: a project pinning `arrayref` 0.3.10, `internment` 0.8.7 or `append-only-vec` 0.1.9 that already has the `.crate` cached locally keeps building fine, and `cargo audit` reports clean.\n\nIf versions deleted for malware are deliberately out of scope, because the version is gone from the registry and an advisory would have nothing to point at, that seems a defensible line. It would just be useful to have it stated somewhere, since a fair amount of CI treats a clean `cargo audit` as the answer to \"were we affected\".","bodyHTML":"\u003cp dir=\"auto\"\u003eWas closing this as not planned the intended call? Asking genuinely, because the practical effect is that \u003ccode class=\"notranslate\"\u003ecargo audit\u003c/code\u003e produces no signal for this incident.\u003c/p\u003e\n\u003cp dir=\"auto\"\u003eThe blog post and the crates.io deletions cover anyone who reads either. The gap is the automated path: a project pinning \u003ccode class=\"notranslate\"\u003earrayref\u003c/code\u003e 0.3.10, \u003ccode class=\"notranslate\"\u003einternment\u003c/code\u003e 0.8.7 or \u003ccode class=\"notranslate\"\u003eappend-only-vec\u003c/code\u003e 0.1.9 that already has the \u003ccode class=\"notranslate\"\u003e.crate\u003c/code\u003e cached locally keeps building fine, and \u003ccode class=\"notranslate\"\u003ecargo audit\u003c/code\u003e reports clean.\u003c/p\u003e\n\u003cp dir=\"auto\"\u003eIf versions deleted for malware are deliberately out of scope, because the version is gone from the registry and an advisory would have nothing to point at, that seems a defensible line. It would just be useful to have it stated somewhere, since a fair amount of CI treats a clean \u003ccode class=\"notranslate\"\u003ecargo audit\u003c/code\u003e as the answer to \"were we affected\".\u003c/p\u003e","bodyVersion":"123d8f42a37b804f7908219d1e3f97e54d27188a9f157c62912d8389f8369728","isHidden":false,"viewerCanUpdate":false,"repository":{"id":"MDEwOlJlcG9zaXRvcnk4MzE1MzU2MQ==","name":"advisory-db","owner":{"__typename":"Organization","id":"MDEyOk9yZ2FuaXphdGlvbjI1Mzk3MjQy","login":"rustsec","url":"https://github.com/rustsec"},"isPrivate":false,"viewerCanCreateIssues":false,"slashCommandsEnabled":false,"nameWithOwner":"rustsec/advisory-db","databaseId":83153561},"reactionGroups":[{"content":"THUMBS_UP","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"THUMBS_DOWN","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"LAUGH","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"HOORAY","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"CONFUSED","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"HEART","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"ROCKET","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}},{"content":"EYES","viewerHasReacted":false,"reactors":{"totalCount":0,"nodes":[]}}],"__isNode":"IssueComment"},"cursor":"Y3Vyc29yOnYyOpPPAAABoB-yXNAAqjUzNTc3MjM0MzA="}]},"backTimelineItems":{"pageInfo":{"hasPreviousPage":true,"startCursor":null},"totalCount":11,"edges":[]}}},"safeViewer":null}},"timestamp":1787239025}]},"title":"Issue","appPayload":{"initial_view_content":{"can_edit_view":true},"current_user":null,"current_user_settings":{"preferred_emoji_skin_tone":null,"copilot_show_functionality":false,"use_single_key_shortcut":false},"paste_url_link_as_plain_text":false,"base_avatar_url":"https://avatars.githubusercontent.com","help_url":"https://docs.github.com","sso_organizations":null,"current_sso_orgs_match_dismissed_cookie":null,"multi_tenant":false,"tracing":false,"tracing_flamegraph":false,"catalog_service":"github/issues","scoped_repository":{"id":"MDEwOlJlcG9zaXRvcnk4MzE1MzU2MQ==","owner":"rustsec","name":"advisory-db","is_archived":false,"has_projects_enabled":true},"saved_views":null,"best_match_sort_enabled":false,"sidebar_expanded":true,"issue_search_type":"ISSUE_HYBRID","transactionalMessageBanner":null,"copilotSurveyBanner":null,"enabled_features":{"use_pull_request_subscriptions_enabled":false,"pull_request_single_subscription":true,"disable_issues_react_ssr":false,"copilot_natural_language_github_search":false,"private_avatars":false,"reserved_domain":true,"notifyd_issue_watch_activity_notify":false,"notifyd_enable_issue_thread_subscriptions":false,"timeline_best_effort_count_optimization":false,"copilot_auto_assign_metadata":false,"copilot_workspace_cross_repo_selection":false,"copilot_agent_mode":false,"issues_react_force_turbo_nav":false,"issues_react_client_side_caching":false,"copilot_swe_agent":false,"react_version_mismatch_detection":false,"issues_react_graceful_not_found_handling":false,"issue_create_relationships":false,"issues_relates_to_issues_search":false,"milestone_closed_issues_prioritization":true,"tasklist_block":false,"issues_create_semantic_similarity_analytics":false,"semantic_similarity_duplicate_issue_detection":true,"issue_cca_visualization":false,"issues_relates_to_relationship":true,"issues_relates_to_semantic_suggestions":false,"personal_block_from_comment":false,"issue_pinned_views":false}}} Malware: arrayref 0.3.10 executes a remote payload at build time via typosquatted proc-macro1 #3161New issueCopy linkNew issueCopy linkClosed as not plannedClosed as not plannedMalware: arrayref 0.3.10 executes a remote payload at build time via typosquatted proc-macro1#3161Copy linkDescriptionjhobernopened on Aug 20, 2026Issue body actionsarrayref 0.3.10 (2026-08-20 07:15 UTC, by droundy) adds a first-ever dependency on proc-macro1 1.0.107 (07:11 UTC, by dtolney), whose build.rs downloads and executes a remote binary. Both are live as I file this; [email protected] emailed separately.

Affected: arrayref =0.3.10, proc-macro1 all versions. 1.0.106 is a clean copy of proc-macro2 published 5h earlier — staging, but not itself malicious. arrayref ≤0.3.9 are clean.

Delivery: 0.3.5–0.3.9 are all yanked under the owner account, so cargo's consider updating to a version that is not yanked warning is the lure. That is how I hit it. droundy is presumably compromised.

const SRC_URL_PARTS: &[&str] = &["aHR0cHM6Ly8=", "MjMuMjU0Lg==", "MTY1Lg==", "MTEyOg==", "OTA4OS8="]; const END_URL_PARTS: &[&str] = &["MjMuMjU0Lg==", "MTY1Lg==", "MTEyOg==", "NDQz"]; → https://23.254.165.112:9089/, 23.254.165.112:443. Fetched over rustls with an AcceptAll ServerCertVerifier (all three verify methods return success unconditionally), selecting rust-crate_0.1.0/_0.2.0/_0.3.0/_0.4.0 by target, then executed with the second URL as argv[1]:

This article was aggregated automatically by CyberWire Daily's newsfeed engine. Original reporting: github.com.