VulnerabilityRUSTSEC-2026-0259 · arone
RUSTSEC-2026-0259: `arone` was removed from crates.io due to malicious code
Short answerA security vulnerability in the arone crate: `arone` was removed from crates.io due to malicious code. No severity score was published. No fixed version: replace the crate or remove the affected code path.
| Crate | arone |
|---|---|
| Type | Vulnerability |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | not scored |
| Published | 2026-08-20 |
| Last changed | 2026-08-21 |
| Also known as | none |
What to do
- Find who pulls it in:
cargo tree -i arone. - Avoid the affected API, or replace the crate.
Details from the advisory
We identified that arone contained malicious code executed through a build script.
This crate had 7 versions, with the most recent one being published at 2026-08-18. The crate was removed from crates.io on 2026-08-20 and the user account was locked.
This crate was used as part of a malware campaign targeted at users of arrayref, which was downloaded 2,285 times before being removed; see the arrayref advisory for more detail.
References
- Package: crates.io/crates/arone
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0259.html
- Web: blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for arone
Up next
Same cratearone: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?