WNBA Commissioner Cathy Engelbert sent a memo to the WNBA Players’ Association, where she addresses the gender issue that might impact future WNBA Drafts. Former NBA center Enes Kanter declared for th...

## What happened On 2026-08-20 at 7:15 UTC we got a report that the `proc-macro1` crate was malicious. The Rust Security Response Team verified this to be the case: the crate had a build script that was downloading a malicious payload. This crate `proc-macro1` and others like it (`proc-macro-en`, `aovine`, `arone`, `aronenao`, `tinymember`) have been deleted. Furthermore, we discovered that the popular arrayref crate had recently been republished and made to depend on this crate, with the most recent versions yanked. We have removed the malicious version and unyanked the maliciously-yanked versions. Other crates by that author (internment, append-only-vec) were also affected so we have done the same for those, and locked the account as a precaution. We do not believe the author of `arrayref` to be acting maliciously, but their computer or credentials are likely compromised, and we are attempting to contact them. ## What you need to do We recommend you check your local dependencies to ensure these crates were not pulled in. Here are the malicious versions that we deleted from crates.io: * `append-only-vec@0.1.9`: published at `2026-08-20T07:37:49Z`, deleted at `2026-08-20T09:25:24Z`. Online for 107 minutes. * `arrayref@0.3.10`: published at `2026-08-20T07:15:00Z`, deleted at `2026-08-20T08:41:40Z`. Online for 86 minutes. * `internment@0.8.7`: published at `2026-08-20T07:34:07Z`, deleted at `2026-08-20T09:04:11Z`. Online for 90 minutes. * `proc-macro1`, `proc-macro-en`, `aovine`, `arone`, `aronenao`, `tinymember` (any versions). You can quickly check if these crates have been used locally by going through `~/.cargo/registry/cache` with this command: find ~/.cargo/registry/cache -type f \( \ -name 'append-only-vec-0.1.9.crate' -o \ -name 'arrayref-0.3.10.crate' -o \ -name 'internment-0.8.7.crate' -o \ -name 'proc-macro1-*.crate' -o \ -name 'proc-macro-en-*.crate' -o \ -name 'aovine-*.crate' -o \ -name 'arone-*.crate' -o \ -name 'aronenao-*.crate' -o \ -name 'tinymember-*.crate' \ \) -print ## Thanks We'd like to thank the Research Team at Nextron Systems GmbH for initially discovering this and reporting it to us. We'd also like to thank Emily Albini, Manish Goregaokar, Marco Ieni, Tobias Bieniek, Ubiratan Soares, and Walter Pearce for participating in the response here.