---
id: RUSTSEC-2026-0266
title: '`internment` 0.8.7 was removed from crates.io due to a malicious dependency'
summary: '`internment` 0.8.7 was removed from crates.io due to a malicious dependency'
severity: none
vendor: internment
product: internment
ecosystem: rust
affected:
  - internment >= 0.8.7-0
published: '2026-08-20'
updated: '2026-08-20'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0266'
references:
  - url: 'https://crates.io/crates/internment'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0266.html'
  - url: 'https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref'
tags:
  - osv
  - rust
ingestedAt: '2026-08-20T19:23:10.051Z'
---

## Overview

A new version of the `internment` crate was published with a direct dependency
on `proc-macro1`, which would execute a malicious build script.

This compromised version was published on 2026-08-20 and removed approximately
90 minutes later, with no evidence of actual usage.

## Affected packages

- `internment >= 0.8.7-0`

## Remediation

Refer to the advisory for the patched release.