---
id: RUSTSEC-2026-0262
title: >-
  `append-only-vec` 0.1.9 was removed from crates.io due to a malicious
  dependency
summary: >-
  `append-only-vec` 0.1.9 was removed from crates.io due to a malicious
  dependency
severity: none
vendor: append-only-vec
product: append-only-vec
ecosystem: rust
affected:
  - 'append-only-vec >= 0.1.9, < 0.1.10-0'
patched:
  - append-only-vec 0.1.10-0
published: '2026-08-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T11:00:02.677736709Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0262'
references:
  - url: 'https://crates.io/crates/append-only-vec'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0262.html'
  - url: 'https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref'
tags:
  - osv
  - rust
ingestedAt: '2026-08-20T19:23:09.908Z'
---

## Overview

A new version of the `append-only-vec` crate was published with a direct dependency
on `proc-macro1`, which would execute a malicious build script.

The compromised version of this crate was published on 2026-08-20, and was
removed approximately 107 minutes later.

The compromised crate version was used as part of a malware campaign targeted
at users of `arrayref`, which was downloaded 2,285 times before being removed;
see [the `arrayref` advisory][arrayref-advisory] for more detail.

[arrayref-advisory]: https://rustsec.org/advisories/RUSTSEC-2026-0260.html

## Affected packages

- `append-only-vec >= 0.1.9, < 0.1.10-0`

## Remediation

Upgrade to a patched release:

- `append-only-vec 0.1.10-0`