Attackers exploited a maintainer account associated with the popular Rust package arrayref to publish a malicious version that runs malware on developers’ devices while projects are being built. During a time window of no more than 23 minutes, the operation also affected the append-only-vec and internment packages in a software supply chain attack.
StepSecurity reported that the affected versions were arrayref 0.3.10, append-only-vec 0.1.9, and internment 0.8.7, with all three packages managed by the same account. arrayref is widely used, recording more than 53 million downloads in the last 90 days and more than 245 million downloads in total. It is included in projects and tools related to cryptography, graphics, and Rust graphical interfaces, as well as components used in the Ethereum and Solana ecosystems.
How Was the Attack Carried Out?
The attackers added a dependency on a package named proc-macro1, which impersonates the well-known proc-macro2 package. Most of the original package source remained unchanged, making the tampering more difficult to detect for those who review only software diffs.
proc-macro1 contained a build.rs file that runs automatically during compilation. The file reconstructs components of the malicious payload from Base64-encoded parts, then selects an operating-system-specific payload, including Linux, Windows, and macOS on x86-64 and ARM64 architectures. On Unix, the payload is written to /tmp/rust-setup and run as a separate process, while on Windows the attack creates a file named rust-setup.ps1 inside the TEMP directory and uses wscript.exe and a VBS script to keep the process running.
What Can the Malware Steal?
According to Wiz’s analysis, the second stage collects host information and credentials. The malware extracts login data from the SQLite databases of Google Chrome, Brave, and Edge browsers. It also establishes persistence through Registry Run on Windows, LaunchAgent on macOS, and systemd on Linux. The payload receives an address as an argument, which is believed to be the address of a command-and-control server.
Timeline and What It Means for Developers
The campaign began at 01:17 UTC on August 20, 2026, with the creation of a GitHub account impersonating prominent Rust developer David Tolnay, followed by a similar account on crates.io. A clean version of proc-macro1 was published at 01:55, followed by the malicious version 1.0.107 at 07:11. Four minutes later, arrayref 0.3.10 was published through the legitimate droundy account associated with David Roundy, while versions 0.3.5 through 0.3.9 were removed, potentially causing installation tools to select the malicious version.
The incident was reported at 07:54, and crates.io deleted the proc-macro1 package at 08:03 and removed arrayref 0.3.10 from the index at 08:41. Malicious versions of other packages— aovine, arone, aronenao, and tinymember—were also removed.
Response Steps
Anyone who installed the affected versions during the exposure window, which lasted nearly an hour and a half, should treat the environment as compromised. The review should include searching Cargo.lock files for suspicious versions, checking for dropped files, and inspecting connections to 23.254.165[.]112 over ports 9089 and 443. If a compromise is confirmed, the analyses recommend rotating all credentials, CI tokens, signing keys, and other secrets, then rebuilding the environment from trusted backups. Unaffected projects should pin a version known to be safe until the status of the maintainer accounts becomes clear.