Is It Dead Yet?
arrayrefcrates.io
- latest 0.3.9
- licence BSD-2-Clause
- stars 89
- checked yesterday
- registry ↗
- repository ↗
Signals · last 1 check
State history 1
| When | Change |
|---|---|
| 2026-09-03 | first verdict: drifting |
Supply-chain history 1
-
account hijacked 2026-08 0.3.10
A compromised maintainer account republished all three with a dependency on a look-alike proc-macro crate whose build script ran a payload at compile time, and yanked the older arrayref releases so Cargo would prefer the malicious one.
Deleted from crates.io within two hours, the yanked versions restored, the account locked.
Source: Rust blog post-mortem by the Security Response Team, 20 August 2026. History, not a warning about today — the verdict above is about maintenance now.
Badge
Drop this in your README. It re-renders itself as the verdict changes.
[](https://isitdeadyet.dev/crates/arrayref)Watch it
Get told when arrayref changes state, changes licence, or is deprecated — instead of finding out during an incident.
Free for up to 25 packages. Signing in is a link sent to your email — there is no password to choose.