RustSec logo

History ⋅ Edit ⋅ JSON (OSV)

RUSTSEC-2026-0262

append-only-vec 0.1.9 was removed from crates.io due to a malicious dependency
Reported
Issued
Package
append-only-vec (crates.io)
Type
Vulnerability
Categories
References
Patched
no patched versions
Unaffected
  • <=0.1.8

Description

A new version of the append-only-vec crate was published with a direct dependency on proc-macro1, which would execute a malicious build script.

This compromised version was published on 2026-08-20 and removed approximately 107 minutes later, with no evidence of actual usage.

Advisory available under CC0-1.0 license.