What happened
On August 20, the Rust project confirmed that malicious versions of three widely used Rust libraries — arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 — were published to the crates.io package registry after an attacker gained control of a maintainer account. The poisoned releases added a dependency on proc-macro1, a lookalike of the legitimate proc-macro2 package, whose build script downloaded a malicious payload while code was being compiled. Simply building a project that pulled in an affected version was enough to trigger the infection; none of the library's actual functions had to run. The Rust security team removed the releases within roughly 86 to 107 minutes of publication and locked the compromised account, and says the maintainer was a victim, not a participant. BleepingComputer reports the payload delivered information-stealing malware, and arrayref alone has logged more than 53 million downloads over the past 90 days. Researchers at Wiz noted significant overlap with tactics seen in North Korea-linked campaigns.
Why it matters for your business
If your company builds software in Rust — or pays a contractor who does — this is a reminder that the open-source supply chain is a live attack surface. The malicious window was short, but build servers and developer laptops that compiled during it may have been exposed, and stolen developer credentials are a common first step toward a deeper compromise of your product or your customers. Attacks that run at build time are especially dangerous because they slip past code review entirely.
What to do about it
- Have your dev team check lockfiles and the local cargo cache for the affected versions.
- If a build pulled one in on August 20, treat that machine as compromised: rotate credentials, tokens, and SSH keys used on it.
- Pin dependency versions and review new transitive dependencies before they reach CI.