🧰 append-only-vec

The items that name it 7

• Rust 1.100 Will Add Dependency Cooldowns to Cargo
  articleas classification.key entities2026-10-20
• The State of Open Source Supply Chain Attacks
  articleas classification.key entities2026-08-23
• Rust Supply-Chain Attack: arrayref, internment, and append-only-vec Poisoned by the proc-macro1 Build-Time Dropper
  writeupas affected products2026-08-22

  Rust crate compromised via same maintainer account; 4.5M all-time downloads; also pulled in transitively by internment; deleted from crates.io; last safe version 0.1.8

• The OpenSourceMalware Show #18
  talkas classification.key entities2026-08-21
• Socket: Popular Rust Crates Compromised in Build-Time Supply Chain Attack
  writeupas affected products2026-08-20

  Legitimate Rust crate republished with malicious proc-macro1 dependency

• Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns
  writeupas affected products2026-08-20It is written here as append-only-vec (Rust crate).

  Malicious version published to crates.io on August 20, 2026.

• Popular Rust crates arrayref, append-only-vec, and internment compromised in Supply Chain Attack
  writeupas affected products2026-08-20

  Compromised Rust crate, 4M downloads