Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
A compromised maintainer account published malicious versions of three Rust crates, which added a typosquatted dependency that downloaded and executed a remote payload during compilation. The affected releases were arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.…
Intelligence analysis by Llama
A compromised maintainer account published malicious versions of three Rust crates, which added a typosquatted dependency that downloaded and executed a remote payload during compilation. The affected releases were arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, all published on August 20, 2026, and removed within 86 to 107 minutes. Developers are advised to search ~/.ca…
Imagine you're building a house, and someone sneaks a bad brick into the wall. When you build the wall, the bad brick gets installed, and it can cause problems later on. That's what happened in this case. A bad maintainer account added a bad dependency to some popular Rust crates, which then installed a bad brick (a malicious payload) when people built their projects. Luckily, the bad bricks were removed quickly, but it's a good reminder to always check what you're installing and to keep your dependencies up to date.
Analysis
Background
The Rust Project has deleted malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account published releases that added a typosquatted dependency whose build script downloaded and executed a remote payload during compilation. The affected releases are arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, all published from the same owner account on August 20, 2026, and all removed within 86 to 107 minutes.
What Changed
The malicious code sat in the build script of the injected dependency, which was a genuine copy of proc-macro2. The build script reassembled its payload host and command-and-control (C2) address from base64 fragments at build time. It then installed a custom certificate verifier whose three verification methods return success unconditionally, disabling TLS validation. It selected one of four payloads by operating system and CPU architecture. On Unix and macOS it wrote the bytes to /tmp/rust-setup, marked the file executable, and spawned it detached with the C2 address as its first argument. On Windows it wrote a PowerShell script to %TEMP% and launched it hidden through a VBScript launcher under wscript.exe, then abandoned the child process, a step commented in the source as escaping Cargo's job object so the build does not wait on it.
Implications
The attack demonstrates the importance of supply chain security in the Rust ecosystem. The compromised maintainer account was able to publish malicious code, which was then executed during compilation. This has significant implications for developers who rely on the Rust crates.io repository. The Rust Security Response Team has deleted the malicious versions and advised developers to search ~/.cargo/registry/cache for the deleted crate files and to pin arrayref at 0.3.9 or earlier.
Key points
- A compromised maintainer account published malicious versions of three Rust crates, which added a typosquatted dependency that downloaded and executed a remote payload during compilation.
- The affected releases were arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, all published on August 20, 2026, and removed within 86 to 107 minutes.
- Developers are advised to search ~/.cargo/registry/cache for the deleted crate files and to pin arrayref at 0.3.9 or earlier.
- The Rust Security Response Team has deleted the malicious versions and is attempting to contact the compromised maintainer account.
The Rust Security Response Team was able to quickly identify and remove the malicious code, which prevented any potential damage. This demonstrates the effectiveness of the Rust community's security processes and the importance of having a robust response plan in place.
The attack highlights the potential risks of supply chain security in the Rust ecosystem. If a compromised maintainer account is able to publish malicious code, it can have significant implications for developers who rely on the Rust crates.io repository. This could lead to the installation of malicious code, which can cause problems later on.
