Rust developers hit by supply-chain attack on arrayref crate

Key points

• Attackers compromised the maintainer account behind three Rust libraries (arrayref, append-only-vec and internment) on August 20, publishing malicious versions within a 23-minute window.
• The arrayref package has been downloaded over 53 million times in the past 90 days and 245 million times in total, making it a heavy hitter in the Rust world.
• The malware ran automatically when developers built their code, then stole browser passwords and set itself to survive reboots on Windows, macOS and Linux.
• Researchers at Wiz say the attack's infrastructure overlaps with recent North Korean supply-chain campaigns.
• Developers who pulled the poisoned versions during the 1.5-hour exposure window should assume their machines were breached.

Hackers broke into the account of a maintainer who looks after several widely used Rust libraries and pushed out booby-trapped updates that ran malware on developers' computers the moment they built their code. Rust is a popular programming language, and these libraries (called "crates") are shared building blocks that thousands of projects depend on.

The poisoned releases, first reported by BleepingComputer, were arrayref 0.3.10, append-only-vec 0.1.9 and internment 0.8.7. All three sit under the same maintainer account. Arrayref alone has racked up more than 245 million lifetime downloads and is pulled in by cryptography, graphics and blockchain tooling, including projects tied to Ethereum and Solana.

How did the attackers pull it off?

They added a hidden dependency. The attackers left the real library code untouched but wired in a package called proc-macro1, a look-alike of the legitimate proc-macro2 crate (a technique called typosquatting, where criminals register a name almost identical to a trusted one).

Inside proc-macro1 was a file named build.rs that Rust runs automatically during compilation. It rebuilt the attack from base64-encoded fragments (a common way to hide code as harmless-looking text) and picked a payload matching the developer's operating system: Linux, Windows, or Intel and Apple Silicon Macs.

On Unix machines the malware dropped a file at /tmp/rust-setup and ran it as a background process. On Windows it wrote %TEMP%\rust-setup.ps1 and used a hidden Windows script host to keep itself running.

What did the malware actually do?

It stole credentials and phoned home. Analysis from cloud security firm Wiz found the second-stage code pulled login details out of Google Chrome, Brave and Microsoft Edge by reading their local SQLite password databases.

It also set itself up to survive reboots: a Registry Run key on Windows, a LaunchAgent on macOS, a systemd service on Linux. The payload connected to 23.254.165.112 on ports 9089 and 443, the command-and-control address attackers used to receive stolen data.

Wiz researchers noted the infrastructure overlaps with recent North Korean supply-chain operations known as Mastra and axios.

Timeline of the attack

The exposure window ran roughly 1.5 hours. Anyone who ran cargo build against the poisoned versions during that time should treat their machine as breached.

What should developers do now?

Check your Cargo.lock files for the affected versions and look for the dropped files at /tmp/rust-setup or %TEMP%\rust-setup.ps1. Review network logs for traffic to 23.254.165.112 on ports 9089 or 443.

If you find signs of infection, rotate every credential the machine could touch: cloud tokens, CI secrets, code-signing keys, browser-saved passwords. Rebuild the machine from a clean backup rather than trying to clean it in place.

Projects that were not hit should pin a known-good version of arrayref, append-only-vec and internment until the maintainer's account situation is fully sorted out. Reports from StepSecurity, SafeDep and Aikido include full indicators of compromise.