⚠️ A few hours ago, a malicious crate was discovered on crates.io which spread as a dependency of `arrayref` and some other crates, likely due to compromised credentials. The affected versions have been deleted.
For details and how to see if you are impacted, see: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
@rust I appreciate the work put into this response. Would be useful to have the datetime that the compromised releases were made. I'm currently assuming it happened today but that's not clear from the post.
@rukai The malicious dependency (`proc-macro1`) was published today at 07:11 UTC and the malicious version of `arrayref` depending on it was published at 07:15 UTC. We deleted it at 08:03 UTC.
We'll also investigate the publication times of the other affected crates and add this information to the blog post.
