started · updated
Rust crates arrayref, internment, and append-only-vec hit by supply chain attack
A supply chain attack targeted the Rust programming language ecosystem after a maintainer's account was compromised. Malicious versions of three widely used crates—arrayref (0.3.10), internment (0.8.7), and append-only-vec (0.1.9)—were published to crates.io on August 20, 2026.
The attack utilized a typosquatted dependency named “proc-macro1” to inject a malicious build script. This script executed automatically during the compilation process, downloading a second-stage payload designed to steal credentials from web browsers and development environments. Because the payload ran during the build phase, developers could be infected simply by compiling a project that resolved to the compromised versions, without ever explicitly calling the malicious code.
The Rust Security Response Team identified and removed the malicious releases within approximately 86 to 107 minutes. While the arrayref crate has over 245 million all-time downloads, RustSec reported no evidence that the malicious versions were actually utilized before being yanked. Security researchers at Wiz noted that the attack's infrastructure shares similarities with campaigns attributed to North Korean threat actors.
Developers are advised to audit their local build caches (~/.cargo/registry/cache) and pin arrayref to version 0.3.9 or earlier to ensure safety.
Entities
Andrew Gallant · Nextron Systems GmbH · Rust Project · Rust Security Response Team · Wiz · crates.io
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 3 SOURCES] The malicious versions were removed from crates.io within approximately 86 to 107 minutes of being published. cybernoz.com · borncity.com · www.clubic.com
- [● 3 SOURCES] The malicious dependency used a typosquatted name, proc-macro1, to mimic the legitimate proc-macro2 crate. www.csoonline.com · www.cryptopolitan.com · www.clubic.com
- [● 2 SOURCES] The malicious code executed automatically during the compilation process via a build script without requiring the crate's functions to be called. www.csoonline.com · dev.to
- [● 3 SOURCES] The maintainer of the affected crates likely had their credentials or computer compromised rather than acting maliciously. cybernoz.com · blog.rust-lang.org · thehackernews.com
- [● 2 SOURCES] The attack shares infrastructure with recent supply-chain campaigns attributed to North Korean threat actors. www.csoonline.com · www.cryptopolitan.com
- [● 3 SOURCES] The arrayref crate has recorded 245 million all-time downloads. www.csoonline.com · borncity.com · www.clubic.com
- [● 2 SOURCES] There is no evidence that any malicious version of the affected crates was actually used before they were removed. cybernoz.com · thehackernews.com
- [● 3 SOURCES] The affected releases were arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9. cybernoz.com · blog.rust-lang.org · dev.to