Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0266

`internment` 0.8.7 was removed from crates.io due to a malicious dependency

Published Aug 20, 2026 · Updated Aug 21, 2026 · Assigned by RUSTSEC

Description

A new version of the `internment` crate was published with a direct dependency
on `proc-macro1`, which would execute a malicious build script.

The compromised version of this crate was published on 2026-08-20, and was
removed approximately 90 minutes later.

The compromised version was used as part of a malware campaign targeted at
users of `arrayref`, which was downloaded 2,285 times before being removed; see
[the `arrayref` advisory][arrayref-advisory] for more detail.

[arrayref-advisory]: https://rustsec.org/advisories/RUSTSEC-2026-0260.html

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io internment >= 0.8.7-0 — RUSTSEC-2026-0266

References