GCVE-110-OSM-2026-10792

append-only-vec 0.1.9 was published by the same compromised droundy account, at the same time as the malicious arrayref 0.3.10 release, as part of the same account-compromise supply-chain campaign involving the typosquatted proc-macro1 crate. Malicious payload found in: dependency graph / release timing Behavior: Published simultaneously with arrayref 0.3.10 from the same compromised maintainer account (droundy). Flagged by the community as part of the same compromise; specific payload details not yet published beyond confirmation of malicious status.