`append-only-vec` 0.1.9 was removed from crates.io due to a malicious dependency

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

A new version of the `append-only-vec` crate was published with a direct dependency on `proc-macro1`, which would execute a malicious build script. The compromised version of this crate was published on 2026-08-20, and was removed approximately 107 minutes later. The compromised crate version was used as part of a malware campaign targeted at users of `arrayref`, which was downloaded 2,285 times before being removed; see [the `arrayref` advisory][arrayref-advisory] for more detail. [arrayref-advisory]: https://rustsec.org/advisories/RUSTSEC-2026-0260.html

Source published

20 Aug 2026 12:00:00 UTC

Source modified

20 Oct 2026 11:00:02 UTC

Observed here

24 Oct 2026 13:19:54 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.