Rust Supply Chain Attack on arrayref Crate

The Rust Security Response Team has deleted malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account published releases that added a typosquatted dependency. That dependency executed a remote payload during compilation, putting developers at risk across the Rust ecosystem.

What Happened: Hackers Poison arrayref Rust Crate to Push Infostealer Malware

On August 20, 2026, at 07:15 UTC, attackers compromised the maintainer account behind the widely used Rust crate arrayref. They published a malicious version (0.3.10) that added a typosquatted dependency called proc-macro1. This package impersonated the legitimate proc-macro2 crate.

Within a 23-minute window, the attacker also poisoned two other crates maintained by the same account: append-only-vec (0.1.9) and internment (0.8.7). The Rust Security Response Team deleted all three malicious versions within 86 to 107 minutes. Consequently, the exposure window was brief but significant.

The arrayref crate alone has more than 245 million lifetime downloads and over 53 million downloads in the past 90 days. Moreover, it is used by cryptography tools like blake3, Rust GUI frameworks such as egui, eframe, and iced, and components used in Ethereum and Solana blockchain projects.

Technical Details of the Rust Crate Supply Chain Attack

The attack leveraged a typosquatting technique combined with build-time code execution. The malicious proc-macro1 crate contained a build.rs script that ran automatically during compilation.

This script reconstructed its infrastructure from base64-encoded fragments. It selected a payload matching the host operating system and architecture. Furthermore, it installed a custom certificate verifier that disabled TLS validation unconditionally. The script then installed a stage-2 implant that beaconed to a command-and-control server.

Payload Delivery and Execution

On Unix systems, the malware wrote to /tmp/rust-setup, marked it executable, and launched it as a detached process. On Windows, it created %TEMP%\rust-setup.ps1 and used a hidden wscript.exe with a VBS launcher. The payload received a command-and-control address as an argument.

Credential Theft and Persistence

According to analysis from cloud security company Wiz, the second-stage capabilities included exfiltrating host information and browser credentials. The malware collected credentials from Google Chrome, Brave, and Edge by querying SQLite login databases.

Persistence was established through multiple mechanisms:

• Windows: Registry Run key
• macOS: LaunchAgent
• Linux: systemd user service

Timeline of Events

01:17 UTC	GitHub account impersonating developer David Tolnay created
01:55 UTC	Benign proc-macro1 version 1.0.106 published
07:11 UTC	Malicious proc-macro1 version 1.0.107 published
07:15 UTC	arrayref 0.3.10 published; previous versions yanked
07:34 UTC	internment 0.8.7 published
07:37 UTC	append-only-vec 0.1.9 published
07:54 UTC	Incident reported to Rust Security Response Team
08:03 UTC	proc-macro1 deleted from crates.io
08:41 UTC	Malicious arrayref 0.3.10 removed

Business and Operational Impact

The potential impact of this supply chain attack is enormous. The arrayref crate has 245 million lifetime downloads, while append-only-vec and internment have a combined 19 million installs. Because the malicious code ran during compilation, developers did not need to explicitly invoke any function from the compromised crates. Simply building a project that resolved the dependency was enough to trigger the payload.

Moreover, the attacker yanked previous versions of arrayref (0.3.5 through 0.3.9). This action left the malicious 0.3.10 as the only non-yanked version, which forced Cargo to suggest updating to it. Therefore, developers who ran routine dependency updates may have pulled the malicious version automatically.

Key Impact Areas

• Developer workstations: Build-time execution means CI/CD pipelines and local development environments were both at risk
• Blockchain projects: Ethereum and Solana dependencies increased risk for cryptocurrency wallet developers
• Credential exposure: Browser credential theft could lead to lateral movement and further compromise
• Downstream consumers: 403 distinct crates on crates.io depend on arrayref, amplifying exposure

Threat Actor Attribution

Wiz researchers noted significant infrastructure overlap with recent DPRK (North Korean) supply chain attacks. Previous campaigns such as the Mastra npm supply chain attack and the axios npm compromise showed similar techniques and infrastructure. However, definitive attribution has not been confirmed.

Mitigation and Recommendations

Developers and organizations using Rust should take immediate action to detect and remediate potential compromise.

Immediate Actions for Defenders

1. Check local caches: Search ~/.cargo/registry/cache for the deleted crate files using the Rust Security Response Team’s recommended command
2. Review Cargo.lock files: Verify that none of the malicious versions are locked in your projects
3. Pin safe versions: Pin arrayref at 0.3.9 or earlier until the maintainer situation is clarified
4. Rotate credentials: If compromise is confirmed, rotate all accessible credentials, CI tokens, signing keys, and other secrets immediately
5. Rebuild environments: Rebuild compromised development and CI environments from safe backups

Network Indicators of Compromise

Organizations should monitor for traffic to the following known indicators:

• C2 IP: 23.254.165.112 on ports 9089 and 443
• Domain: hwsrv-798836.hostwindsdns.com
• Files: /tmp/rust-setup, %TEMP%\rust-setup.ps1, %TEMP%\rust-setup-launch.vbs
• Binaries: rust-crate_0.1.0, _0.2.0, _0.3.0, _0.4.0

Long-Term Supply Chain Security Measures

• Enable dependency verification and audit tools in CI pipelines
• Pin exact dependency versions in Cargo.toml and review lock files before deployment
• Monitor crates.io for unauthorized yanking or new releases in critical dependencies
• Implement software bill of materials (SBOM) tracking for Rust projects

Bottom line: This attack demonstrates that even brief windows of exposure in widely used open-source packages can have massive downstream consequences. Developers who built Rust projects on August 20 should assume compromise and take immediate remediation steps.

Incident Summary

Incident:	Rust Supply Chain Attack on arrayref, append-only-vec, and internment crates
Disclosure Date:	August 20, 2026
Affected Packages:	arrayref 0.3.10, append-only-vec 0.1.9, internment 0.8.7, proc-macro1
Total Downloads at Risk:	245+ million lifetime (arrayref alone)
Exposure Window:	86 to 107 minutes
Malware Type:	Infostealer / Build-time payload
Attribution:	Possible DPRK overlap (unconfirmed)
Patch Status:	Malicious versions removed; no CVE assigned

References

1. Bill Toulas, BleepingComputer, “Hackers poison arrayref Rust crate to push infostealer malware,” August 20, 2026, https://www.bleepingcomputer.com/news/security/hackers-poison-arrayref-rust-crate-to-push-infostealer-malware/, accessed August 21, 2026.
2. The Hacker News, “Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads,” August 20, 2026, https://thehackernews.com/2026/08/rust-supply-chain-attack-puts-build.html, accessed August 21, 2026.
3. Rust Security Response Team, “Supply chain attack on arrayref,” August 20, 2026, https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/, accessed August 21, 2026.
4. StepSecurity, “arrayref Rust Crate Supply Chain Attack,” August 20, 2026, https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack, accessed August 21, 2026.
5. Wiz, “Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns,” August 20, 2026, https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns, accessed August 21, 2026.