🎯 Transitive dependency poisoning

The items that name it 2

• Rust Supply-Chain Attack: arrayref, internment, and append-only-vec Poisoned by the proc-macro1 Build-Time Dropper
  writeup2026-08-22

  internment depends on append-only-vec, so a single internment resolve could pull two poisoned crates into one dependency tree

• Compromised Injective SDK npm Package Exfiltrates Wallet Keys and Mnemonics
  advisory2026-07-09

  Threat actor published 17 additional @injectivelabs scoped packages pinned to the malicious sdk-ts version to compromise users who did not directly install the malicious package