Hackers compromised the maintainer account for the widely used Rust crate arrayref and injected malware that executes on developers’ systems during compilation.
Within 23 minutes, the attackers also compromised two other Rust crates, append-only-vec and internment, as part of the same software supply chain attack.
The arrayref crate is a popular Rust library used in cryptography, graphics, blockchain tools, and other software projects. It was downloaded more than 53 million times during the past 90 days and has surpassed 245 million lifetime downloads.
According to a report from application security firm StepSecurity, the malicious versions are arrayref 0.3.10, append-only-vec 0.1.9, and internment 0.8.7. All three crates were managed by the same compromised account.
The attackers also injected a dependency into a package named proc-macro1, a typosquat designed to resemble the popular proc-macro2 crate. The malicious package retained most of the legitimate upstream source code, making the changes more difficult to detect.
Researchers found that a build.rs script inside proc-macro1 automatically executes during compilation. The script rebuilds the malware from Base64-encoded fragments and selects a payload for the host operating system, including Linux x86-64, Windows x86-64, macOS x86-64, and macOS ARM64.
StepSecurity said the attackers also published multiple versions of additional crates named aovine, aronone, aronenao, and tinymember. These packages have since been removed from crates.io.
On Unix-based systems, the malware writes a file to /tmp/rust-setup, marks it as executable, and launches it as an isolated process.
On Windows, the malware creates %TEMP%\rust-setup.ps1 and uses a hidden wscript.exe process together with a Visual Basic Script launcher to keep the payload running.
The payload receives an argument containing an address that appears to point to a command-and-control server.
According to an analysis by cloud security firm Wiz, the second-stage malware is designed to steal host information and credentials.
The malware reportedly collects credentials from Google Chrome, Brave, and Microsoft Edge by querying each browser’s SQLite login database.
The threat also establishes persistence using a Registry Run key on Windows, a LaunchAgent on macOS, and a systemd service on Linux.
Rust crate supply chain attack: Timeline and impact
The potential impact of the Rust supply chain attack is significant. In addition to arrayref’s more than 245 million lifetime downloads, append-only-vec and internment have recorded approximately 19 million combined installations.
Projects that use arrayref include Rust GUI frameworks and libraries such as blake3, egui, eframe, and iced. The crate is also used by components associated with Ethereum and Solana development.
The attack began at 01:17 UTC on August 20 with the creation of a GitHub account impersonating prominent Rust developer David Tolnay. The attackers later created a similar account in the crates.io registry.
At 01:55 UTC, the attacker published a benign copy of proc-macro2 under the name proc-macro1, version 1.0.106. A malicious update, version 1.0.107, was published at 07:11 UTC.
At 07:15 UTC, arrayref version 0.3.10 was published through the legitimate drowny account, associated with David Roundy. The release removed versions 0.3.5 through 0.3.9, potentially forcing some projects to install the malicious version.
The incident was reported at 07:54 UTC. Crates.io removed proc-macro1 at 08:03 UTC and removed arrayref 0.3.10 from the registry index at 08:41 UTC.
Cybersecurity companies StepSecurity, SafeDep, and Aikido each published technical analyses of the attack and shared indicators of compromise.
Wiz researchers said the campaign infrastructure overlaps with infrastructure linked to recent North Korean supply chain attacks, including the Mastra and Axios incidents.
Developers who installed any of the compromised packages during the approximately 90-minute exposure window should assume that their environments may have been compromised.
Recommended checks include reviewing Cargo.lock files, searching for dropped files, and looking for network traffic to 23.254.165.[.]112 over ports 9089 and 443.
If a compromise is confirmed, organizations should immediately rotate all accessible credentials, CI/CD tokens, signing keys, and other secrets. Affected development environments should also be rebuilt from trusted backups.
Until the maintainers’ accounts and the affected projects are confirmed to be secure, developers should pin known-safe versions of the impacted dependencies and carefully review all build artifacts.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com