MAL-2026-14333

    Dashboard / Malicious Package / MAL-2026-14333

    MAL-2026-14333

    Published: 20 Aug 2026Last Modified: 20 Aug 2026

    Summary: Malicious code in append_only_vec (crates.io)

    Details: append-only-vec 0.1.9 was published to crates.io from the same maintainer account (droundy) as the trojanized arrayref and internment releases, which appears to be compromised. The release adds a dependency on an attacker-controlled crate whose build script downloads and executes an architecture-specific remote binary at build time from https://23.254.165.112:9089/, passing 23.254.165.112:443 as a command-and-control address. Part of a coordinated crates.io campaign on 2026-08-20. The malicious release has been removed from crates.io; earlier append-only-vec releases are unaffected.

    References: https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/, https://github.com/rustsec/advisory-db/issues/3161

    Affected packages

    Package

    Name: append-only-vec

    Purl: pkg:cargo/append-only-vec

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.1.9
    MAL-2026-14333 | CVE-DB