The arrayref crate is a popular Rust library with more than 53 million downloads over the past 90 days — and its maintainer account was briefly hijacked to deliver an information‑stealing malware payload that executed on developers’ machines during compilation.
Scope: what was affected and who uses arrayref
StepSecurity reported that three crates maintained by the same account were poisoned: arrayref (malicious release 0.3.10), append-only-vec (0.1.9), and internment (0.8.7). The collective reach is substantial: arrayref alone has more than 245 million lifetime downloads, and append-only-vec and internment together account for nearly 19 million installs. Over the last 90 days arrayref saw more than 53 million downloads.
StepSecurity notes that projects depending on arrayref include blake3, Rust GUI frameworks such as egui, eframe, and iced, and components used in Ethereum and Solana, underscoring the broad surface exposed by a single compromised dependency.
How the attacker delivered code: a dependency typo‑squat
Rather than altering the upstream source, the attacker injected a dependency on a package named proc-macro1 — a typosquat impersonating the legitimate proc-macro2 crate. According to the analysis, the attacker retained the original crate source and added the malicious dependency so that the attack would execute during normal compilation.
StepSecurity identified proc-macro1@1.0.106 as a benign copy of proc-macro2 published first; the attacker then released a malicious update, version 1.0.107, which included an automatically executed build script ('build.rs'). StepSecurity also reported that the attacker published multiple versions of four other crates (aovine, arone, aronenao, tinymember) that have since been removed from crates.io.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageMalware behavior: build-time execution, payload selection, and data theft
StepSecurity's analysis shows the proc-macro1 build script reconstructs its infrastructure from base64‑encoded fragments and chooses a payload matching the host OS (Linux x86-64, Windows x86-64, macOS x86-64, and macOS ARM64). On Unix systems the malware writes to /tmp/rust-setup, marks it executable, and launches it as a detached process. On Windows it creates %TEMP%\\rust-setup.ps1 and uses a hidden wscript.exe plus a VBS launcher to keep the process running.
The payload receives an address as an argument that is believed to be a command‑and‑control (C2) address. Wiz's analysis reports second‑stage capabilities including exfiltrating host information and credentials. The researchers say the malware collects credentials from Google Chrome, Brave, and Edge by querying SQLite login databases. Persistence is established via the Registry Run key on Windows, LaunchAgent on macOS, and systemd on Linux.
Timeline: impersonation, publication, and takedown within a 23‑minute poisoning window
The incident unfolded rapidly on August 20. At 01:17 UTC a GitHub account impersonating prominent Rust developer David Tolnay was created and a similar account was added to the crates.io registry. At 01:55 the attacker published proc-macro1@1.0.106 (a benign copy), followed by a malicious update at 07:11 (proc-macro1@1.0.107). At 07:15 arrayref 0.3.10 was published through the legitimate droundy (David Roundy) account while versions 0.3.5 through 0.3.9 were removed, a move StepSecurity says was potentially intended to force installations to the malicious release.
The incident was reported at 07:54 UTC. crates.io deleted proc-macro1 at 08:03 and removed arrayref 0.3.10 from the index at 08:41. StepSecurity, SafeDep, and Aikido have published technical analyses and indicators of compromise.
What this means for developers, security teams, and package maintainers
- Developers: If you built packages during the exposure window (nearly 1.5 hours), assume compromise. Recommended checks include searching Cargo.lock files for the malicious dependency, looking for the dropped files such as /tmp/rust-setup or %TEMP%\\rust-setup.ps1, and reviewing traffic to 23.254.165[.]112 on ports 9089 and 443.
- Security teams: Where compromise is confirmed, the guidance is to rotate all accessible credentials, CI tokens, signing keys, and other secrets, and rebuild environments from safe backups. Wiz's findings highlight credential theft from Chromium-based browsers and the establishment of persistence across major OS families.
- Package maintainers: Until the maintainer situation is clarified, clean projects should pin known‑safe versions of affected dependencies rather than allowing floating updates. StepSecurity noted other malicious packages the attacker published have been removed from crates.io, illustrating that attackers may use multiple typosquats and repository accounts in a single campaign.
Wiz also observed that "the campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios." The Blue Report 2026 is cited to warn that "overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply," a sober reminder that initial compromise can quickly lead to persistent, hard‑to‑erase access.
The takeaways are concrete: a short window of account abuse produced a high‑reach supply‑chain compromise that executed at build time, stole credentials, and established persistence. For any team that consumed these crates during the exposure window, the safe course is to treat affected hosts and secrets as compromised, follow the published IOCs and remediation steps, and rebuild from known‑good sources.
Source: BleepingComputer — Hackers poison arrayref Rust crate to push infostealer malware
