Poisoned Rust crates used to deliver credential-stealing malwareThe Rust Security Response Team disclosed a supply-chain compromise involving arrayref, internment, append-only-vec, and typosquatted proc-macro1. Malicious releases stayed live on crates.io for 86 to 107 minutes, with build scripts fetching and executing payloads for Linux, Windows, Intel Macs

https://www.theregister.com/security/2026/08/21/hackers-poison-popular-rust-crates-to-steal-developers-credentials/5291075