CVE-2026-77649 (CVSS 9.8): The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue depen (opens in a new tab)
Why readinternment 0.8.7 shipped a dependency that registers with a command and control server and executes during cargo build, so any project that compiled it is an incident to investigate rather than a version to bump.
The crate pulled in a rogue dependency tied to the wider arrayref proc-macro compromise, giving the attacker arbitrary code execution at build time on whatever machine ran the compile. That means CI runners and developer workstations, with whatever secrets those build environments hold, not just the produced binary. Check build logs and lockfiles for the affected version, treat any hit as a credential exposure, and read the rust-lang advisory for the full list of compromised packages in the campaign.