Append Only Vec
Monthly
Build-time arbitrary code execution affects the append-only-vec Rust crate version 0.1.9, which was trojanized as part of the August 2026 arrayref-family supply chain attack. The crate pulls in a rogue dependency that beacons to a command-and-control server and offers the operator arbitrary code execution on any machine that compiles a project depending on it. This is classified CWE-506 (embedded malicious code); no public exploit tooling is published because the malware itself is the payload, and it is not listed in CISA KEV.
Build-time arbitrary code execution affects the append-only-vec Rust crate version 0.1.9, which was trojanized as part of the August 2026 arrayref-family supply chain attack. The crate pulls in a rogue dependency that beacons to a command-and-control server and offers the operator arbitrary code execution on any machine that compiles a project depending on it. This is classified CWE-506 (embedded malicious code); no public exploit tooling is published because the malware itself is the payload, and it is not listed in CISA KEV.