Rust supply chain attack slips build-time malware into arrayref

Attackers published malicious versions of three widely used Rust crates - arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 - to crates.io on August 20, 2026, and anyone who compiled a project that resolved one of them ran malware on their machine. The payload executed during cargo build itself, so a developer or CI runner never had to call the poisoned code to be compromised.

The exposure window was short but the blast radius was not. According to The Hacker News, arrayref has 245,385,500 all-time downloads, 53,905,601 of them in the 90 days before the attack, and 403 crates list it as a direct dependency. Security firm Wiz says arrayref appears in more than 35% of all environments it observes, and in three-quarters of environments where Rust is present at all.

How the attack worked

The Rust Security Response Team says it received a report at 07:15 UTC on August 20 and verified that the new arrayref release "had a build script that was downloading a malicious payload." The malicious versions did not tamper with arrayref's own code. Instead, they added a new dependency named proc-macro1 - a typosquat of the legitimate proc-macro ecosystem - whose build script downloads and executes a remote binary at compile time.

StepSecurity's analysis puts the mechanism bluntly: "Simply building any project whose lockfile resolved arrayref 0.3.10 was enough to detonate the payload. The crate's code never needs to be called." The same analysis found the attacker yanked every clean 0.3.x release of arrayref in a scripted burst, "weaponizing Cargo's own 'yanked version' warning as the delivery mechanism" - developers responding to the warning would upgrade straight into the malicious release.

Per Wiz, the downloaded backdoor reconstructed command-and-control URLs from Base64 fragments, disabled TLS certificate validation, and shipped platform-specific payloads with persistence for Windows, macOS, and Linux plus credential enumeration from browser profiles. Alongside proc-macro1, the Rust Security Response Team identified five more attacker-controlled crates: proc-macro-en, aovine, arone, aronenao, and tinymember.

crates.io removed the malicious releases quickly: arrayref 0.3.10 was live for 86 minutes, internment 0.8.7 for 90, and append-only-vec 0.1.9 for 107, according to timestamps reported by The Hacker News. StepSecurity observes that "the whole operation, from persona creation to registry takedown, fits inside a single working morning."

Who was behind it

The compromise came through the maintainer's account, not the maintainer. "We do not believe the author of arrayref to be acting maliciously, but their computer or credentials are likely compromised," the Rust Security Response Team said in its disclosure.

Wiz reports the campaign's infrastructure substantially overlaps with recent North Korean supply chain operations: it shares the same 23.254.164.0/23 Hostwinds address range used in the Mastra npm campaign attributed to DPRK-linked Sapphire Sleet, and its command-and-control traffic went to an IP that appears in Google Cloud Threat Intelligence's analysis of the axios npm attacks, also attributed to North Korea. The playbook already familiar from npm has now reached crates.io.

What this means for developers

If any of your machines or CI runners built a Rust project on the morning of August 20 (UTC), check whether the lockfile resolved arrayref 0.3.10, internment 0.8.7, or append-only-vec 0.1.9, and inspect your local registry cache - the Rust Security Response Team's advisory asks users to check cached dependencies for the malicious crate names listed above. Treat a machine that built one of them as compromised, not merely exposed: per Wiz, the payload installs persistence and enumerates browser credentials, so rotate secrets that machine could reach.

The structural lesson is that build scripts are a remote-code-execution surface, and lockfiles are the control. A committed Cargo.lock pins exact versions, so a fresh cargo install or an un-pinned CI job was the vulnerable path during the 86-minute window. This attack also turned a safety feature into bait - the yank-warning trick means "a yanked version means upgrade now" is no longer a safe reflex. Verify what you are upgrading into, and treat a brand-new dependency appearing in a long-stable crate's diff as a stop-the-line signal.