Rust Supply Chain Attack Targets Popular Crates with Malware
This week, hackers infiltrated the Rust ecosystem by injecting malware into several widely used packages, turning routine software builds into a vector for compromise. The Rust Security Response Team disclosed the attack on Thursday after receiving a report about a malicious crate, proc-macro1, which fetched malware from a remote server during build processes.
The attack extended beyond a single package. The threat actor published a poisoned version of arrayref (0.3.10), a legitimate and heavily downloaded Rust crate, by adding proc-macro1 as a dependency. To increase exposure, the attacker also yanked recent legitimate releases of arrayref, pushing users toward the compromised version. The Rust team confirmed that the package’s maintainer was not responsible, suspecting instead that their credentials or system were compromised. The same developer’s other crates internment (0.8.7) and append-only-vec (0.1.9) were similarly targeted.
The malicious releases were live for a brief but critical window: arrayref for 86 minutes, internment for 90 minutes, and append-only-vec for 107 minutes before being removed. Despite the short exposure, arrayref alone has over 245 million lifetime downloads, while append-only-vec exceeds 4 million, though the number of affected builds remains unknown.
Security firm Aikido’s analysis revealed that the attacker left the original source code largely intact, instead adding proc-macro1 a typosquat of the legitimate proc-macro2 as a dependency. The malware, embedded in proc-macro1’s build.rs file, executed during Cargo’s compilation process, identifying the target’s OS and architecture before downloading a tailored payload. Malware variants were found for Linux, Windows, Intel Macs, and Apple Silicon.
The second-stage payload went beyond basic data theft, targeting Chromium-based browser profiles (Chrome, Brave, Edge) and cryptocurrency wallet extensions. It also included persistence mechanisms and command-and-control functionality.
In response, the Rust team removed the malicious crates (proc-macro1, proc-macro-en, aovine, arone, aronenao, and tinymember) and advised developers to audit their Cargo lockfiles and local caches. The attack was initially discovered by Nextron Systems’ research team, though the method of the maintainer’s compromise, the number of affected developers, and the full scope of executed payloads remain unclear.
Despite the brief window of exposure, the attackers strategically targeted high-traffic packages, underscoring the risks of supply chain compromises in open-source ecosystems.
Aikido TPRM report: https://www.rankiteo.com/company/aikido-security
"id": "aik1787326600",
"linkid": "aikido-security",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Unknown (potentially thousands '
'of developers and downstream '
'applications)',
'industry': 'Software Development',
'location': 'Global',
'name': 'Rust crates: arrayref, internment, '
'append-only-vec, proc-macro1, proc-macro-en, '
'aovine, arone, aronenao, tinymember',
'type': 'Open-source software packages'}],
'attack_vector': 'Compromised package dependencies',
'data_breach': {'data_exfiltration': 'Yes (malware fetched tailored payloads '
'from remote servers)',
'personally_identifiable_information': 'Yes (browser '
'profiles, wallet '
'data)',
'sensitivity_of_data': 'High (personally identifiable '
'information, financial data)',
'type_of_data_compromised': 'Browser profiles, cryptocurrency '
'wallet extensions, system '
'information'},
'date_publicly_disclosed': '2023-10-12',
'description': 'Hackers infiltrated the Rust ecosystem by injecting malware '
'into several widely used packages, turning routine software '
'builds into a vector for compromise. The attack involved '
'malicious crates like *proc-macro1*, which fetched malware '
'from a remote server during build processes. The threat actor '
'also compromised legitimate crates such as *arrayref*, '
'*internment*, and *append-only-vec* by adding malicious '
'dependencies and yanking legitimate releases to push users '
'toward compromised versions.',
'impact': {'brand_reputation_impact': 'Damage to Rust ecosystem trust and '
'open-source supply chain security',
'data_compromised': 'Chromium-based browser profiles (Chrome, '
'Brave, Edge), cryptocurrency wallet '
'extensions',
'identity_theft_risk': 'High (due to browser profile and wallet '
'data exposure)',
'operational_impact': 'Potential compromise of development '
'environments and downstream applications',
'payment_information_risk': 'High (due to cryptocurrency wallet '
'exposure)',
'systems_affected': 'Systems compiling affected Rust crates'},
'initial_access_broker': {'backdoors_established': 'Malicious dependencies '
'injected into legitimate '
'crates',
'entry_point': 'Compromised maintainer credentials '
'or system',
'high_value_targets': 'Developers using popular '
'Rust crates'},
'investigation_status': 'Ongoing (method of maintainer compromise and full '
'scope of payloads unclear)',
'lessons_learned': 'Supply chain attacks in open-source ecosystems can have '
'widespread impact even with short exposure windows. '
'Maintainer credential security and dependency auditing '
'are critical.',
'motivation': 'Data theft, cryptocurrency wallet compromise, persistence, '
'command-and-control',
'post_incident_analysis': {'corrective_actions': 'Enhanced maintainer '
'security (e.g., MFA), '
'improved dependency '
'auditing, faster response '
'to malicious package '
'reports',
'root_causes': 'Compromised maintainer credentials '
'or system, typosquatting, '
'dependency injection, lack of '
'multi-factor authentication for '
'maintainers'},
'ransomware': {'data_exfiltration': 'Yes'},
'recommendations': 'Audit Cargo lockfiles and local caches, monitor for '
'typosquatted dependencies, enforce multi-factor '
'authentication for package maintainers, and enhance '
'supply chain security practices.',
'references': [{'source': 'Rust Security Response Team'},
{'source': 'Aikido Security Analysis'},
{'source': 'Nextron Systems Research Team'}],
'response': {'communication_strategy': 'Public disclosure by Rust Security '
'Response Team, advisories to '
'developers',
'containment_measures': 'Removal of malicious crates from '
'crates.io, advisory to audit Cargo '
'lockfiles and local caches',
'incident_response_plan_activated': 'Yes (Rust Security Response '
'Team)',
'remediation_measures': 'Yanking malicious versions, advising '
'developers to check dependencies',
'third_party_assistance': 'Aikido Security, Nextron Systems'},
'stakeholder_advisories': 'Rust Security Response Team advisory to developers '
'to audit dependencies and caches.',
'title': 'Rust Supply Chain Attack Targets Popular Crates with Malware',
'type': 'Supply Chain Attack',
'vulnerability_exploited': 'Compromised maintainer credentials or system, '
'typosquatting, dependency injection'}