Victor Adossi (Aug 20 2026 at 14:32): Victor Adossi (Aug 20 2026 at 14:32):Heads up for anyone who hasn't seen this yet, the arrayref crate was compromised in v3.10:
https://github.com/rustsec/advisory-db/issues/3161
wasmtime doesn't use it but the crate does show up in the cargo audit config (not the version that was hacked, of course!):
Probably no need to take any action but it might be worth intentionally rejecting the vulnerable version (or removing the audit etc), but it looks like the crates team is also helpfully stepping in here which is great. Probably a do-nothing to be
Victor Adossi (Aug 20 2026 at 14:34):Ah OK well maybe there's some cause for a bit of concern --
I think with resolution rules if someone was building wasm-tools locally and ran cargo update at the time that the version was available maybe they could have got it via blake3 if it updated to that version...? I don't think this happened but was just checking important projects to see if arrayref the crate showed up anywhere
Chris Fallin (Aug 20 2026 at 14:44):Well that's mildly terrifying. Discussion on the linked rust-lang zulip indicates the remote payload is a browser credential stealer...
Lann Martin (Aug 20 2026 at 14:56):or cargo install wasm-tools (without --locked)? :grimacing:
Lann Martin (Aug 20 2026 at 15:04):find ~/.cargo/registry/ -name 'arrayref-0.3.10*'
^ this works to find 0.3.9 on my workstation
Victor Adossi (Aug 20 2026 at 15:06):https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
Ah here is the rust team announcement
Victor Adossi (Aug 20 2026 at 15:07):Lann Martin said:
find ~/.cargo/registry/ -name 'arrayref-0.3.10*'^ this works to find 0.3.9 on my workstation
Just ran this, sigh of relief
Last updated: Aug 30 2026 at 09:07 UTC