On Aug. 20, 2026, attackers briefly hijacked three widely used Rust crates—arrayref@0.3.10, internment@0.8.7 and append-only-vec@0.1.9—publishing them to crates.io in a 23-minute window between 07:15 and 07:38 UTC. Each added a typosquatted proc-macro1 dependency whose Cargo build script downloaded and ran a remote payload during compilation without changing the original crate source or needing a downstream application flaw, shifting risk onto developer workstations and CI environments that hold secrets, signing keys and infrastructure access. Arrayref, foundational in Solana token interfaces and core infrastructure, had roughly 245 million lifetime downloads on its prior clean release; the other crates also appear in Solana and, to a lesser extent, Ethereum tooling chains. The malicious versions were live 86, 90 and 107 minutes respectively before the Rust security team yanked them and locked the maintainer account over a likely machine or credential compromise. Researchers including SlowMist, Socket, StepSecurity and Wiz reported the incident, with Wiz linking infrastructure to North Korean actors tracked as Sapphire Sleet. No widespread exploits have been publicly reported; teams are urged to check Cargo.lock for the three versions, inspect CI for unusual outbound traffic, and refresh caches, since unpublishing does not rewrite local lockfiles or rebuild already-shipped containers.