Hackers compromised the maintainer account behind the widely used Rust crate arrayref to introduce malware that executed on developers’ systems during compilation.
Within a 23-minute window, the attacker also poisoned two other crates, append-only-vec and internment, in the same supply-chain attack.
The arrayref crate is a popular Rust library with more than 53 million downloads over the past 90 days that is used by cryptography, graphics, and blockchain tools.
A report from application security company StepSecurity notes that the malicious Rust crate releases were arrayref 0.3.10, append-only-vec 0.1.9, and internment 0.8.7, all maintained by the same account.
The hacker injected a dependency on a package called proc-macro1, a typosquat impersonating the popular proc-macro2 crate, while retaining the rest of the upstream source code completely unchanged.
According to the researchers, a script in proc-macro1, named ‘build.rs,’ is automatically executed during compilation, reconstructing its infrastructure from base64-encoded fragments and selecting a payload that matches the host OS (Linux x86-64, Windows x86-64, macOS x86-64, and macOS ARM64).
StepSecurity says that the attacker also published multiple versions of four crates themselves (aovine, arone, aronenao, tinymember), which have been removed from crates.io.
On Unix systems, the malware writes to /tmp/rust-setup, marks it executable, and launches it as a detached process.
On Windows, it creates %TEMP%rust-setup.ps1 and uses a hidden wscript.exe and VBS launcher to keep the process running.
The payload receives an address as an argument, believed to be a command-and-control address.
According to an analysis from cloud security company Wiz, the second-stage capabilities include exfiltrating host info and credentials.
The researchers say that the malware collects credentials from Google Chrome, Brave, and Edge browsers by querying SQLite login databases.
Persistence is established via the Registry Run key on Windows, LaunchAgent on macOS, and systemd on Linux.
Timeline and impact
The potential impact of this supply-chain attack is significant, as arrayref alone has more than 245 million lifetime downloads, while the collective count for append-only-vec and internment is nearly 19 million installs.
Projects using arrayref include blake3, Rust GUI frameworks such as egui, eframe, and iced, and components used in Ethereum and Solana.
The attack started at 01:17 UTC on August 20, when a GitHub account impersonating prominent Rust developer David Tolnay was created, followed by a similar account in the crates.io registry.
At 01:55, the attacker published proc-macro1@1.0.106, a benign copy of proc-macro2, followed by a malicious update through version 1.0.107, published at 7:11.
At 07:15, arrayref 0.3.10 was published through the legitimate droundy (David Roundy) account, while versions 0.3.5 through 0.3.9 were removed, potentially to force installation of the malicious release.
The incident was reported at 07:54. Crates.io deleted proc-macro1 at 08:03 and removed arrayref 0.3.10 from the index at 08:41.
Cybersecurity companies StepSecurity, SafeDep, and Aikido have each published a technical analysis of the supply-chain attack and shared indicators of compromise.
Wiz researchers note that “the campaign’s infrastructure overlaps with recent DPRK [North Korean] supply chain attacks, including Mastra and axios.”
Developers who installed either during the exposure window of nearly 1.5 hours should assume compromise.
Recommended checks include searching Cargo.lock files, looking for the dropped files, and reviewing traffic to 23.254.165[.]112 on ports 9089 and 443.
Where compromise is confirmed, it is recommended to rotate all accessible credentials, CI tokens, signing keys, and other secrets, and rebuild the environment from safe backups.
Clean projects should pin a known-safe version of the affected dependencies until the maintainer situation is clarified and resolved.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
