MAL-2026-14333

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/crates.io/append_only_vec/MAL-2026-14333.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-14333
Published
2026-08-20T00:00:00Z
Modified
2026-08-21T00:01:43.018305124Z
Summary
Malicious code in append_only_vec (crates.io)
Details

append-only-vec 0.1.9 was published to crates.io from the same maintainer account (droundy) as the trojanized arrayref and internment releases, which appears to be compromised. The release adds a dependency on an attacker-controlled crate whose build script downloads and executes an architecture-specific remote binary at build time from https://23.254.165.112:9089/, passing 23.254.165.112:443 as a command-and-control address. Part of a coordinated crates.io campaign on 2026-08-20. The malicious release has been removed from crates.io; earlier append-only-vec releases are unaffected.

References
Credits

Affected packages

crates.io / append-only-vec

Package

Name
append-only-vec
View open source insights on deps.dev
Purl
pkg:cargo/append-only-vec

Affected ranges

Affected versions

0.*
0.1.9

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/crates.io/append_only_vec/MAL-2026-14333.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]