Supply chain attack on arrayref

针对 arrayref 的供应链攻击

Aug. 20, 2026 · Manish Goregaokar on behalf of security-response 2026年8月20日 · Manish Goregaokar 代表安全响应团队

What happened

事件经过

On 2026-08-20 at 7:15 UTC we got a report that the proc-macro1 crate was malicious. The Rust Security Response Team verified this to be the case: the crate had a build script that was downloading a malicious payload. This crate proc-macro1 and others like it (proc-macro-en, aovine, arone, aronenao, tinymember) have been deleted. 2026年8月20日 7:15 UTC，我们收到报告称 proc-macro1 crate 存在恶意行为。Rust 安全响应团队对此进行了核实：该 crate 包含一个会下载恶意负载的构建脚本。目前，proc-macro1 以及其他类似的 crate（proc-macro-en、aovine、arone、aronenao、tinymember）已被删除。

Furthermore, we discovered that the popular arrayref crate had recently been republished and made to depend on this crate, with the most recent versions yanked. We have removed the malicious version and unyanked the maliciously-yanked versions. Other crates by that author (internment, append-only-vec) were also affected so we have done the same for those, and locked the account as a precaution. We do not believe the author of arrayref to be acting maliciously, but their computer or credentials are likely compromised, and we are attempting to contact them. 此外，我们发现流行的 arrayref crate 最近被重新发布，并被添加了对上述恶意 crate 的依赖，其最新版本已被撤回（yanked）。我们已经移除了恶意版本，并恢复了被恶意撤回的版本。该作者旗下的其他 crate（internment、append-only-vec）也受到了影响，因此我们对它们采取了同样的处理措施，并出于预防目的锁定了该账户。我们认为 arrayref 的作者并非恶意，但其计算机或凭据很可能已遭泄露，我们目前正尝试与作者取得联系。

What you need to do

您需要采取的行动

We recommend you check your local dependencies to ensure these crates were not pulled in. Here are the malicious versions that we deleted from crates.io: 我们建议您检查本地依赖项，以确保这些 crate 未被引入。以下是我们从 crates.io 删除的恶意版本：

append-only-vec@0.1.9: published at 2026-08-20T07:37:49Z, deleted at 2026-08-20T09:25:24Z. Online for 107 minutes. append-only-vec@0.1.9：发布于 2026-08-20T07:37:49Z，删除于 2026-08-20T09:25:24Z。在线时长 107 分钟。
arrayref@0.3.10: published at 2026-08-20T07:15:00Z, deleted at 2026-08-20T08:41:40Z. Online for 86 minutes. arrayref@0.3.10：发布于 2026-08-20T07:15:00Z，删除于 2026-08-20T08:41:40Z。在线时长 86 分钟。
internment@0.8.7: published at 2026-08-20T07:34:07Z, deleted at 2026-08-20T09:04:11Z. Online for 90 minutes. internment@0.8.7：发布于 2026-08-20T07:34:07Z，删除于 2026-08-20T09:04:11Z。在线时长 90 分钟。
proc-macro1, proc-macro-en, aovine, arone, aronenao, tinymember (any versions). proc-macro1, proc-macro-en, aovine, arone, aronenao, tinymember（所有版本）。

You can quickly check if these crates have been used locally by going through ~/.cargo/registry/cache with this command: 您可以通过以下命令检查 ~/.cargo/registry/cache，快速确认这些 crate 是否在本地被使用过：

find ~/.cargo/registry/cache -type f \( \
  -name 'append-only-vec-0.1.9.crate' -o \
  -name 'arrayref-0.3.10.crate' -o \
  -name 'internment-0.8.7.crate' -o \
  -name 'proc-macro1-*.crate' -o \
  -name 'proc-macro-en-*.crate' -o \
  -name 'aovine-*.crate' -o \
  -name 'arone-*.crate' -o \
  -name 'aronenao-*.crate' -o \
  -name 'tinymember-*.crate' \
\) -print

Thanks

致谢

We’d like to thank the Research Team at Nextron Systems GmbH for initially discovering this and reporting it to us. We’d also like to thank Emily Albini, Manish Goregaokar, Marco Ieni, Tobias Bieniek, Ubiratan Soares, and Walter Pearce for participating in the response here. 我们要感谢 Nextron Systems GmbH 的研究团队，他们最初发现了此问题并向我们报告。我们还要感谢 Emily Albini、Manish Goregaokar、Marco Ieni、Tobias Bieniek、Ubiratan Soares 和 Walter Pearce 参与了此次应急响应。