news
Rust Gets Security Black Eye, Releases New Version
-
Rust Blog ☛ The Rust Programming Language Blog: Supply chain attack on arrayref [Ed: Rust is not secure]
On 2026-08-20 at 7:15 UTC we got a report that the
proc-macro1crate was malicious.The Rust Security Response Team verified this to be the case: the crate had a build script that was downloading a malicious payload.
This crate
proc-macro1and others like it (proc-macro-en,aovine,arone,aronenao,tinymember) have been deleted. -
LWN ☛ Supply chain attack on arrayref (Rust blog)
The Rust blog reports
on a malicious crate, called proc-macro1, that was uploaded to the
crates.io repository.
-
Rust Blog ☛ The Rust Programming Language Blog: Announcing Rust 1.98.0
The Rust team is happy to announce a new version of Rust, 1.98.0. Rust is a programming language empowering everyone to build reliable and efficient software.