The Rust Project has removed malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account was used to publish releases containing a typosquatted dependency capable of downloading and executing a remote payload during compilation.
The affected releases were arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, all published on August 20, 2026. The malicious versions remained available for between 86 and 107 minutes before being removed.
The attack was particularly concerning because the malicious code was embedded in the build script of a dependency. This meant that developers did not need to directly call any malicious function. Simply resolving and building a project containing the compromised dependency could trigger execution of the payload.
Developers are advised to check their local Cargo cache for the deleted packages and, specifically, to pin arrayref to version 0.3.9 or earlier until further guidance is available.
There is currently no patched version and no CVE assigned to the incident. RustSec advisories for the affected crates state that there is no evidence the malicious releases were actually used.
Compromised Maintainer Account
The Rust Security Response Team said it received a report that the proc-macro1 crate was malicious at 07:15 UTC on August 20. The report was initially submitted by researchers at Nextron Systems.
Investigators determined that the legitimate maintainer account was likely compromised.
"We do not believe the author of arrayref to be acting maliciously, but their computer or credentials are likely compromised."The account responsible for publishing arrayref belongs to David Roundy, who has been registered on crates.io since 2009. The exact method used to compromise the account has not been disclosed.
The malicious releases were:
- [email protected] — online for 86 minutes
- [email protected] — online for 90 minutes
- [email protected] — online for 107 minutes
Several additional crates, including proc-macro1, proc-macro-en, aovine, arone, aronenao, and tinymember, were also identified as part of the malicious activity.
Typosquatted Dependency Triggered the Attack
Each compromised release added a dependency on proc-macro1, a typosquat of the legitimate and widely used proc-macro2 crate.
The malicious proc-macro1 package intentionally contained source code closely resembling the legitimate crate, allowing normal compilation to proceed without immediately raising suspicion.
The malicious behavior was instead hidden inside its build.rs file.
During compilation, the build script reconstructed the payload server and command-and-control address from Base64-encoded fragments. It also installed a custom certificate verifier that effectively disabled TLS certificate validation.
The malware then selected a payload based on the operating system and CPU architecture.
On Linux and macOS, the payload was written to:
/tmp/rust-setup
and executed as a detached process.
On Windows, it created a PowerShell script inside the user's temporary directory and launched it through a hidden VBScript process.
The technique also attempted to escape Cargo's job-control mechanism so that the build process would not wait for the malicious child process.
How Developers Were Tricked Into Installing It
The attack also involved manipulating previously available versions of arrayref.
Versions 0.3.5 through 0.3.9 were yanked from the registry around the same time the malicious 0.3.10 release was published.
This created a situation in which developers could receive Cargo warnings suggesting that they should upgrade to a non-yanked version.
Because arrayref 0.3.10 satisfied existing dependency requirements using a ^0.3.x version range, projects could automatically resolve the malicious release.
This is particularly significant because arrayref is widely used across the Rust ecosystem.
The crate has accumulated approximately 245 million downloads, with more than 53 million downloads during the preceding 90 days, and hundreds of crates depend on it.
Potentially Affected Dependency Chains
Researchers identified dependency chains through packages such as winit, sctk-adwaita, and tiny-skia that could ultimately resolve to the compromised arrayref 0.3.10 release.
Because these dependencies use compatible caret version ranges, a project that previously allowed arrayref ^0.3.6, for example, could potentially resolve to 0.3.10.
Other Rust packages, including versions of blake3, blake2b_simd, and blake2s_simd, also changed their dependencies around the time of the incident.
Malware Capabilities
According to analysis from Wiz and Nextron researchers, the second-stage malware communicates with its command-and-control infrastructure over HTTPS.
The Windows payload was observed using persistence mechanisms including:
- Windows Registry Run keys
- macOS LaunchAgents
- Linux systemd user services
The malware supports commands for terminating itself, changing its C2 configuration, installing persistence, and downloading and executing additional scripts.
Researchers also reported browser credential-stealing capabilities targeting browsers such as Chrome, Brave, and Edge.
The analyzed Windows payload queried browser SQLite databases for information including website origins and usernames. Researchers noted that their analysis did not find direct extraction of the stored password field in that particular Windows sample.
Indicators of Compromise
Researchers have published several indicators associated with the campaign, including:
Network infrastructure
23.254.165.112:908923.254.165.112:443hwsrv-798836.hostwindsdns.com
Files
/tmp/rust-setup%TEMP%\rust-setup.ps1%TEMP%\rust-setup-launch.vbs
Payload names
rust-crate_0.1.0rust-crate_0.2.0rust-crate_0.3.0rust-crate_0.4.0
Developers investigating potentially affected systems should also examine Cargo caches and build environments for unexpected artifacts or network connections associated with these indicators.
Possible North Korean Connection
Security researchers have identified infrastructure similarities between this incident and several recent software supply-chain compromises attributed or suspected to be connected to North Korean threat actors.
Wiz highlighted overlaps with previous campaigns involving the Mastra npm compromise and the axios compromise.
However, no security vendor has officially attributed this Rust crates.io incident to a named threat actor.
Therefore, the infrastructure overlap should be treated as an investigative clue rather than confirmed attribution.
Cargo Lacks a Default Dependency Cooldown
The incident has also renewed discussion around dependency publishing delays.
Unlike some modern software-security workflows, Cargo does not currently have a stable equivalent of a mandatory cooldown period that prevents newly published packages from being immediately consumed.
A Cargo pull request proposing a global-min-publish-age setting was still open and unmerged as of August 21.
Such a mechanism could potentially provide defenders with additional time to identify malicious packages before they are automatically pulled into downstream builds.
What Developers Should Do
Developers using Rust should immediately:
- Check whether their projects resolved
arrayref 0.3.10,internment 0.8.7, orappend-only-vec 0.1.9. - Pin
arrayrefto 0.3.9 or earlier where appropriate. - Search
~/.cargo/registry/cachefor deleted or suspicious crate packages. - Review CI/CD build logs for August 20, 2026.
- Investigate unexpected outbound connections from Rust build environments.
- Check developer machines and CI runners for the reported payload files.
- Review browser credentials and other sensitive data if a compromised build environment is identified.
- Rotate potentially exposed credentials and tokens from affected build environments.
- Prefer locked dependency versions and review unexpected dependency changes before rebuilding.
The incident demonstrates a particularly dangerous supply-chain technique: malicious code does not need to exist in the primary package itself. A compromised dependency executed automatically during the build process can provide attackers with code execution before the developer ever runs the resulting application.
