Malicious code in append_only_vec (crates.io)
append-only-vec 0.1.9 was published to crates.io with malicious code that downloads and executes a remote binary at build time. The maintainer account (droundy) was compromised, also affecting trojanized releases of arrayref and internment. The malicious release has been removed from crates.io.
- Disclosed
- Last updated
- Blast radius
- All users of append-only-vec 0.1.9 who built the package during the window it was available on crates.io
- Ecosystems
- Attack vectors
- Affected entities
- append-only-vec · 0.1.9
On 2026-08-20, a coordinated campaign compromised the crates.io maintainer account droundy, resulting in malicious releases across multiple packages including append-only-vec, arrayref, and internment. The append-only-vec 0.1.9 release added a dependency on an attacker-controlled crate whose build script downloads and executes an architecture-specific remote binary at build time.
The malicious build script contacted https://23.254.165.112:9089/ to retrieve and execute the binary, with 23.254.165.112:443 configured as a command-and-control address. This represents a supply chain compromise at the package level, affecting anyone who built the trojanized version.
The malicious release has been removed from crates.io, and earlier versions of append-only-vec remain unaffected. The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- append-only-vec
- IPs
- 23.254.165.112
Remediation
- Immediately audit any systems that built append-only-vec 0.1.9 for signs of compromise
- Remove append-only-vec 0.1.9 from all dependency locks and upgrade to an earlier unaffected version
- Monitor for outbound connections to 23.254.165.112:9089 and 23.254.165.112:443
- Review build logs for any systems that compiled the malicious version
- Check for any binaries or artifacts downloaded from the attacker-controlled IP address
- Rotate credentials and signing keys associated with affected build systems
Sources
- GitHub Advisory GHSA-m9v3-f7h2-72cp · GitHub Advisory Database
Cite this entry
"Malicious code in append_only_vec (crates.io)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 20, 2026; last updated August 21, 2026. https://supplychainattack.org/incident/malicious-code-in-append-only-vec-crates-io-jjncm5
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in arrayref (crates.io)
arrayref 0.3.10 was published from a compromised maintainer account (droundy) with a malicious dependency on proc-macro1, which downloads and executes a remote binary at build time. The malicious release was removed from crates.io; earlier versions remain unaffected.
CargoMalicious maintainerCompromised package - containedcritical
Malicious code in internment (crates.io)
internment 0.8.7 was published to crates.io with malicious code that downloads and executes a remote binary at build time. The maintainer account (droundy) appears to have been compromised, consistent with a coordinated campaign affecting multiple crates on 2026-08-20. The malicious release has been removed from crates.io.
CargoMalicious maintainerCompromised package - resolvedcritical
Malicious code in express-route-engine (npm)
The npm package express-route-engine contains malicious code that fetches and executes arbitrary JavaScript from a remote JSON store (https://api.jsonbin.io/v3/b/6a4f5816f5f4af5e29762c92) on require/import, with full Node.js privileges. The payload is mutable and can be changed without republishing the package.
npmCompromised packageMalicious maintainer - resolvedcritical
Malicious code in reqcrypt (PyPI)
The reqcrypt PyPI package contains intentionally hidden malicious code that executes arbitrary Python code from attacker-controlled HTTP responses. The PayloadProcessor unconditionally inspects every HTTP response for specific JSON keys and passes base64/gzip/zlib-decoded values to exec(), enabling remote code execution on any system using the library.
PyPICompromised packageMalicious maintainer