Rust ecosystem hit by supply chain attack via malicious arrayref crate
peterjliu · x · 2026-08-21
Rust Security Response Team disclosed a supply chain attack where crates like proc-macro1 contained build scripts downloading malicious payloads. The popular arrayref crate was hijacked to depend on the malicious crate. Malicious versions have been yanked, and the author's account is believed to be compromised. Developers are advised to check their local dependency cache.
Related event: Rust Ecosystem Hit by Supply Chain Attacks with Malicious Crates(2 posts)→
More from Safety
- Critique: interpretability research keeps running intuitions ahead of rigorous evaluation — dhadfieldmenell · 2026-10-16
- Frontier Red Team member: AI worms are dumb today, but the exponential is unsettling — logangraham · 2026-10-16
- Paper warns of "agentic flooding": AI tools are straining courts worldwide — TuhinChakr · 2026-10-16
- NYC comptroller overseeing $325B pension asks Anthropic to delay IPO over safety concerns — rohanpaul_ai · 2026-10-16
- Wired: AI Hacks Leave a Mess That AI Companies Aren't Paying For — Wired AI · 2026-10-16
- Researcher: alignment's basic problems are known, yet almost nobody works on them directly — jd_pressman · 2026-10-16