Product

arrayref

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 20, 2026 · last 21d ago

Timeline2 articles

Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

Compromised maintainer account published malicious versions of popular Rust crates with 245M downloads, delivering a build-time payload via typosquatted proc-macro1 dependency.

The Rust Project deleted malicious releases of arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 from crates.io after a compromised maintainer account added a typosquatted dependency, proc-macro1, whose build script downloaded and executed a remote payload during compilation. Each malicious version was online for 86 to 107 minutes on August 20, 2026, before deletion. The build script disabled TLS validation and deployed OS-specific implants on Unix, macOS, and Windows, with builds alone sufficient to trigger execution. Wiz Research confirmed active exploitation, noting the impacted packages appear in 35% of cloud and code environments and over 75% of Rust-using environments; arrayref alone has 245 million all-time downloads and 403 dependent crates.

The Hacker NewsAug 25, 16:13 UTC · 21d agoMalware in the wild

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Malicious versions of the Rust crate arrayref executed a compile-time backdoor, with infrastructure overlapping recent DPRK supply chain attacks on Mastra and axios.

Wiz researchers report that malicious versions of the arrayref Rust crate ran a backdoor during compilation, compromising developer build pipelines. The campaign's command-and-control infrastructure significantly overlaps with infrastructure used in recent DPRK supply chain attacks, including campaigns against Mastra and axios. Developers using affected crate versions should audit their builds and review dependencies.

Wiz BlogAug 20, 15:56 UTC · 26d agoThreat actor in the wild1

Appears with

vendor Wiz 2 malware rust-setup implant 1 organization Rust Security Response Team 1 organization Wiz 1 product append-only-vec 1 product axios 1 product internment 1 product Mastra 1 product proc-macro1 1 product Rust 1 vendor crates.io 1 vendor Nextron Systems 1 vendor Rust 1 threat actor DPRK 1 victim Rust developers 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.