This package has dated incident reports relevant to its trust history. Check the affected releases and the response before drawing conclusions about its current version.
Read the incident coverage →Check a specific version for known advisories, documented mitigations and evidence-backed earlier-version options. Maintenance health is separate from vulnerability status.
Review remediation options →Loading historical repository activity…
Signals · last 2 checks
Dated reporting about this package. These events are separate from its current maintenance score.
· crates.io
Wiz reported that hijacked releases added a malicious dependency that ran during compilation. Rust responders removed those releases. Wiz also identified infrastructure shared with previously reported DPRK-linked campaigns.
Affected versions: arrayref 0.3.10; internment 0.8.7; append-only-vec 0.1.9
Packages: arrayref · internment · append-only-vec
Source: Wiz Research
| When | Change |
|---|---|
| 2026-10-19 | first verdict: coasting |
account hijacked 2026-08 0.1.9
A compromised maintainer account republished all three with a dependency on a look-alike proc-macro crate whose build script ran a payload at compile time, and yanked the older arrayref releases so Cargo would prefer the malicious one.
Deleted from crates.io within two hours, the yanked versions restored, the account locked.
Source: Rust blog post-mortem by the Security Response Team, 20 August 2026. History, not a warning about today — the verdict above is about maintenance now.
Badge
Drop this in your README. It re-renders itself as the verdict changes.
[](https://isitdeadyet.dev/crates/append-only-vec)Watch it
Get told when append-only-vec changes state, changes licence, or is deprecated — instead of finding out during an incident.
Free for up to 25 packages. Signing in is a link sent to your email — there is no password to choose.