RUSTSEC-2026-0266: 
Rust vulnerability analysis and mitigation

A new version of the internment crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. The compromised version of this crate was published on 2026-08-20, and was removed approximately 90 minutes later. The compromised version was used as part of a malware campaign targeted at users of arrayref, which was downloaded 2,285 times before being removed; see [the arrayref advisory][arrayref-advisory] for more detail. [arrayref-advisory]: https://rustsec.org/advisories/RUSTSEC-2026-0260.html