2026-08-21 Threat analysis
Build-time backdoor hits Rust crates with 245M downloads.
On 20 August 2026, attackers republished arrayref and
two sibling crates with a build script that ran malware during
cargo build — stealing browser credentials at compile
time, on developer and CI machines. The poisoned versions were
live for only ~90 minutes before crates.io yanked them, which is
exactly why a patch-version quarantine is the control that would
have kept them out of your builds entirely.
Our new analysis breaks down the proc-macro1 dropper,
the IOCs to grep for, and — honestly — where a registry helps and
where build sandboxing is the real fix.
Read the full analysis: the Rust crates backdoor →
2026-07-30 New feature
The agent skills repository ships in OrbitalReg.
An agent skills repository is a centralized, versioned store for
artificial intelligence agent capabilities that functions as a
strictly governed software artifact system. Starting today,
OrbitalReg treats your AI agents' skills exactly like the rest of
your supply chain: published and versioned in your registry,
cryptographically signed, scanned at upload, promoted through
review gates, pulled through the verify-on-pull gate, and
recorded in the append-only audit trail.
Why it matters: a skill changes what an agent is allowed to do,
which makes unmanaged skill files the highest-leverage unreviewed
artifact in an agentic pipeline. With the skills repository, a
production agent can only load a skill that someone published,
someone reviewed, and the registry verified — and every one of
those steps is attributable. Air-gapped deployments receive
skills through the same signed import path as every other
artifact.
The feature is live in every tier — like all OrbitalReg security
features, it is not an upcharge.
Read the full AI & agent skills overview →
Field guide: how to govern agent skills like artifacts →
