RUSTSEC-2026-0262None▾ Sunlit`append-only-vec` 0.1.9 was removed from crates.io due to a malicious dependency
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
A new version of the append-only-vec crate was published with a direct dependency
on proc-macro1, which would execute a malicious build script.
The compromised version of this crate was published on 2026-08-20, and was removed approximately 107 minutes later.
The compromised crate version was used as part of a malware campaign targeted
at users of arrayref, which was downloaded 2,285 times before being removed;
see the arrayref advisory for more detail.
append-only-vec >= 0.1.9, < 0.1.10-0Upgrade to a patched release:
append-only-vec 0.1.10-0Connected by shared product, vendor, weakness, or advisory.