Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
Compromised maintainer account published malicious versions of popular Rust crates with 245M downloads, delivering a build-time payload via typosquatted proc-macro1 dependency.
The Rust Project deleted malicious releases of arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 from crates.io after a compromised maintainer account added a typosquatted dependency, proc-macro1, whose build script downloaded and executed a remote payload during compilation. Each malicious version was online for 86 to 107 minutes on August 20, 2026, before deletion. The build script disabled TLS validation and deployed OS-specific implants on Unix, macOS, and Windows, with builds alone sufficient to trigger execution. Wiz Research confirmed active exploitation, noting the impacted packages appear in 35% of cloud and code environments and over 75% of Rust-using environments; arrayref alone has 245 million all-time downloads and 403 dependent crates.
- Compromised maintainer account published malicious arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 versions
- Typosquatted proc-macro1 dependency executed a payload via build script during compilation, no code invocation needed
- Delivery trick leveraged yanking of prior arrayref versions so Cargo auto-selected the malicious 0.3.10
- Implant disabled TLS certificate verification and deployed OS-specific payloads on Unix, macOS, and Windows
- Wiz Research reports the packages exist in 35% of cloud/code environments and over 75% of Rust environments
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1559.002 Execution through Module LoadT1553 Subvert Trust ControlsT1059.001 PowerShellT1071.001 Web Protocols
- Malware
- rust-setup implant
- Victims
- Rust developers
- Organizations
- Rust Security Response Team
From the original article
6 min read at thehackernews.com
The Rust Project has deleted malicious versions of three widely used Rust crates from crates. io after a compromised maintainer account published releases that added a typosquatted dependency whose build script downloaded and executed a remote payload during compilation. The affected releases are arrayref 0.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.