/DISPATCH · 2026-08-21

Rust Supply-Chain Attack Exposed: Three High-Download Crates Inject Infostealer Backdoor at Build Time; 245 Million Combined Downloads

The Rust project yanked malicious versions of arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 on August 20. After a maintainer account compromise, attackers injected a typosquat of proc-macro2 named proc-macro1. The build script auto-downloads and executes a second-stage payload that steals browser credentials. Combined downloads: 245 million.

The Rust project Security Response Working Group emergency-removed three widely used malicious crate versions from crates.io on August 20, 2026: arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9. After a maintainer-account compromise, attackers injected a typosquat of proc-macro2 named proc-macro1. Its build script automatically downloads and executes a remote payload during cargo build, cargo check, CI pipelines, and rust-analyzer static analysis. No developer API call is required. Combined downloads exceed 245 million.

Incident Overview

The three compromised crates come from the same crates.io account (droundy, David Roundy). On the surface they are legitimate, widely used packages: arrayref for array-slice references, internment for string and data interning, append-only-vec for concurrent append-only vectors. arrayref itself has 530k downloads / 90 days. blake3, Rust GUI frameworks egui/eframe/iced, and Ethereum and Solana blockchain components depend on it.

On August 20, 2026 at 01:17 UTC, the attacker registered a GitHub account impersonating well-known Rust developer David Tolnay, then a similar crates.io account. At 01:55, proc-macro1 1.0.106 shipped—an initial copy of real proc-macro2 to build trust. At 07:11, malicious 1.0.107 shipped. At 07:15, arrayref 0.3.10 published via the legitimate droundy account; in the same minute, versions 0.3.5 through 0.3.9 were yanked, forcing cargo to treat 0.3.10 as the only selectable version. At 07:54 a researcher reported to the Rust Security Response WG. At 08:03 proc-macro1 was deleted. At 08:41 arrayref 0.3.10 was deleted. Malicious-version window: 86 to 107 minutes.

Technical Details

Core innovation: malware lives in the injected dependency's build script (build.rs). Once cargo resolves the dependency and compiles, the second-stage payload runs automatically. Developers never import the compromised crate in source. Distinct from prior npm/PyPI supply-chain attacks that fire on runtime import.

proc-macro1 1.0.107 library source is a true copy of proc-macro2. Author field spoofed as David Tolnay rchaitm@gmail.com. Repo points at https://github.com/dtolnay/proc-macro1. Sole added attack code is in build.rs, plus three build-dependencies real proc-macro2 does not need: ureq, rustls, base64.

Attack chain:

Stage 1: Legitimate crate injection. Compromised arrayref/internment/append-only-vec each add a proc-macro1 dependency line in the manifest;
Stage 2: proc-macro1 build.rs dropper. Dynamically concatenates C2 URL and payload URL from base64 fragments: https://23.254.165.112:9089/ and https://23.254.165.112:443;
TLS verification bypass. Installs a custom certificate verifier whose three verify methods unconditionally return success. All TLS checks disabled;
OS branch. Four payloads by host arch: Linux x86-64, Windows x86-64, macOS x86-64, macOS ARM64. Unix/macOS writes /tmp/rust-setup and runs in background. Windows writes %TEMP%\rust-setup.ps1 and launches via wscript.exe and a VBS launcher to detach from the cargo job object;
Persistence. Windows via registry Run key, macOS via LaunchAgent, Linux via systemd service;
Credential theft. Steals passwords from Google Chrome, Brave, Edge SQLite login databases;
Lateral prep. Collects host info and local credential lists for second-stage C2 return.

Impact Assessment

Combined downloads: 245 million. Dependent well-known projects include crypto library blake3, mainstream Rust GUI frameworks egui/eframe/iced, Ethereum and Solana blockchain nodes. JFrog Security Research, StepSecurity, Wiz, SafeDep, and Aikido independently completed technical analysis and shared IoCs.

Wiz notes infrastructure overlap with recent North Korean state supply-chain attacks (Mastra, axios)—a mature APT, not opportunists. Choosing the Rust ecosystem over npm/PyPI reflects two judgments: Rust developers working crypto and HPC are high-value targets; build-time execution (build.rs) as a new attack surface is harder for traditional EDR/SCA to cover than runtime import.

Exposure window was only 86–107 minutes, but two install-behavior factors work against developers: (1) arrayref 0.3.5–0.3.9 were yanked together, so cargo defaults to 0.3.10 as the only selectable version; (2) cargo auto-resolution means projects that directly depend on arrayref may never notice proc-macro1, introduced as a transitive dependency. RustSec currently records three advisories including RUSTSEC-2026-0260. No CVE numbers yet.

Remediation

Emergency action list from the Rust Security Response Working Group, JFrog, and StepSecurity:

Check Cargo.lock for arrayref@0.3.10, internment@0.8.7, append-only-vec@0.1.9, or any proc-macro1 entry;
Scan leftover files: /tmp/rust-setup, %TEMP%\rust-setup.ps1, LaunchAgent plist, systemd unit files, registry Run keys;
Review network traffic for outbound connections to 23.254.165[.]112 ports 9089 and 443 between 07:15 and 09:25 UTC on August 20;
Rotate all accessible credentials: CI tokens, signing keys, SSH keys, cloud access keys, browser-saved passwords;
Isolate or rebuild. Any build machine, CI runner, or developer workstation that ran cargo build inside the window is compromised. Rebuild from clean backup;
Pin safe versions. Temporarily pin arrayref to 0.3.4 or earlier, internment to 0.8.6 or earlier, append-only-vec to 0.1.8 or earlier;
Enable cargo supply-chain defenses. Configure cargo-deny, cargo-audit, cargo-vet in CI. Flag dependencies whose build.rs triggers network downloads as high risk.

Unaffected healthy projects should freeze arrayref/internment/append-only-vec versions after August 21 until the Rust Security Response WG and maintainer David Roundy further communicate the account-compromise path. At a broader level, treat the Rust toolchain as a critical supply-chain node on par with npm/PyPI. Monitor and alert on build.rs execution, dependency resolution, and yank behavior.

References

Compromised Rust crates on crates.io silently execute malware at build time | JFrog
Hackers poison arrayref Rust crate to push infostealer malware
Rust Ecosystem Under Attack: Build-Time Malware Compromises 245M Downloads
RustSec Advisory Database