Description
The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
droundy internment
Default version status: unaffected
0.8.7affected
References
- https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref ↗
- https://github.com/rustsec/advisory-db/issues/3161 ↗
- https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack ↗
- https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/ ↗
- https://rustsec.org/advisories/RUSTSEC-2026-0266.html ↗