The Rust Project has deleted malicious versions of three widely used crates from crates.io after a compromised maintainer account was used to publish booby-trapped releases. The affected versions are arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9, all pushed from the same owner account on August 20, 2026, and all removed within 86 to 107 minutes.
The trick was a typosquatted dependency. Each malicious release added a package whose name was close enough to something familiar, and whose build script downloaded and executed a remote payload during compilation. That last detail is the scary one: you did not have to call anything from the crate for it to hurt you. If your lockfile resolved the poisoned dependency, simply building your project was enough to run the payload.
The Rust Security Response Team unyanked the versions that had been maliciously yanked during the incident, and the practical advice for developers is straightforward - search your ~/.cargo/registry/cache for the deleted crate files, and pin arrayref at 0.3.9 or earlier until the dust settles.
Every dependency you add is a small act of trust in strangers, and this week showed how cheaply that trust can be resold. It is a healthy instinct, and it is part of why Vulpine keeps its dependency surface deliberately small and its protocol deliberately boring - the fewer moving parts, the fewer places for a typosquat to hide.