Arrayref has roughly 245 million lifetime downloads — and for less than two hours this week, a popular release of that package contained a small, deliberate change that funneled malicious code into developer machines.
proc-macro1 build script: the delivery mechanism
The Rust Security Response Team disclosed a supply-chain attack after receiving a tip about a crate named proc-macro1. Investigators found the malicious logic hidden in proc-macro1's build.rs file. Because Cargo, Rust's package manager, runs build scripts during compilation, the build script could detect the operating system and processor architecture of the developer or build machine, download a matching payload, and execute it.
Security firm Aikido reported that the attacker used proc-macro1 as a typosquat of the legitimate proc-macro2 package and largely left the target packages' original source code untouched — the attacker added only a dependency on proc-macro1. That single dependency was the vector that turned routine builds into a route to fetch and run malware.
Yanked releases and the narrow window: 86–107 minutes on crates.io
The attack extended beyond a single crate. An attacker published a new version of arrayref that added proc-macro1 as a dependency, and also pushed malicious versions of two other crates maintained by the same developer: internment and append-only-vec. The attacker then yanked recent legitimate releases of arrayref to encourage users toward the poisoned release.
The poisoned releases were short-lived but strategically placed. Arrayref 0.3.10 was available on crates.io for 86 minutes, internment 0.8.7 for 90 minutes, and append-only-vec 0.1.9 for 107 minutes before removal. Those minutes matter: arrayref is a widely used package with roughly 245 million lifetime downloads, and append-only-vec has more than 4 million downloads, though the teams have not said how many developers pulled the malicious versions during the brief availability.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadAikido and Nextron Systems: what the analysis revealed
Security firm Aikido separately analyzed the attack and described multiple technical details of the second-stage payload. Aikido found compiled malware for Linux, Windows, Intel Macs, and Apple Silicon Macs. The payload did more than download additional files: it targeted Chromium-based browser data, including profiles for Google Chrome, Brave, and Microsoft Edge, and it looked for browser extension storage used by cryptocurrency wallets. The code also contained functionality to establish persistence and to receive commands from the attacker's server.
Rust credits Nextron Systems' research team with initially discovering and reporting the attack. The Rust team deleted a suite of related crates — proc-macro-en, aovine, arone, aronenao, and tinymember — and warned that every version of those crates should be considered malicious.
How developers, Rust maintainers, and build systems are affected
- Developers and build engineers: Because Cargo runs build scripts during compilation, a seemingly small dependency change can trigger remote code execution on developer machines and continuous-integration builders. The Rust team has urged developers to check their Cargo lockfiles and local registry caches for the affected packages.
- Maintainers of popular crates: The Rust team said it does not believe arrayref's maintainer was responsible; instead, it suspects the maintainer's computer or credentials were compromised and noted that the team locked the account while attempting to contact the maintainer. That sequence underscores the risk when a single compromised account can be used to inject a malicious dependency into widely used packages.
- Security teams and incident responders: Aikido's findings on targeted exfiltration (Chromium profiles and extension storage) and persistence mechanisms mean teams should treat builds and developer workstations as potential initial access points and search for related artifacts specific to browser profile theft and command-and-control callbacks.
Conclusion: a short-lived modification, a well-traveled route
The malicious packages were live for under two hours, but the attackers chose a well-traveled route into developers' machines: a small dependency change, a typosquat, and a build script executed by Cargo. Rust and outside researchers have identified the tactics and removed the packages, but several concrete questions remain unanswered in the disclosures: how the legitimate maintainer was compromised, how many developers downloaded the poisoned releases, and how many systems executed the payload. For now, the immediate tasks are straightforward — check lockfiles and local caches — and the larger lesson is stark: supply-chain attacks can be brief and surgical yet still reach large numbers of projects through dependency chains.
