A new version of the internment crate was published with a direct dependency on proc-macro1, which would execute a malicious build script.

The compromised version of this crate was published on 2026-08-20, and was removed approximately 90 minutes later.

The compromised version was used as part of a malware campaign targeted at users of arrayref, which was downloaded 2,285 times before being removed; see the arrayref advisory for more detail.