Description
A new version of the `internment` crate was published with a direct dependency
on `proc-macro1`, which would execute a malicious build script.
The compromised version of this crate was published on 2026-08-20, and was
removed approximately 90 minutes later.
The compromised version was used as part of a malware campaign targeted at
users of `arrayref`, which was downloaded 2,285 times before being removed; see
[the `arrayref` advisory][arrayref-advisory] for more detail.
[arrayref-advisory]: https://rustsec.org/advisories/RUSTSEC-2026-0260.html
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | internment | >= 0.8.7-0 | — | RUSTSEC-2026-0266 |