Hackers compromised a maintainer account for the widely used Rust crate arrayref and planted malware that executed during the build process on developers’ machines. Within a 23-minute window, the attackers also poisoned two related crates, append-only-vec and internment, in the same supply- chain operation.
The arrayref crate is a foundational Rust library with more than 53 million downloads over the past 90 days, relied upon by cryptography tools, graphics libraries, and blockchain projects. Researchers at application security firm StepSecurity identified the malicious releases as arrayref 0.3.10, append-only-vec 0.1.9, and internment 0.8.7, all published through the same compromised account.
Attack Mechanism
The attack worked by injecting a dependency on a package called proc-macro1, which typosquats the legitimate proc-macro2 crate. The rest of the upstream source code remained completely unchanged, making the malicious version difficult to distinguish from a standard update at first glance.
According to StepSecurity‘s analysis, a build script embedded in proc-macro1 runs automatically during compilation. This script reconstructs its command infrastructure from base64-encoded fragments and selects a payload tailored to the host operating system: Linux x86-64, Windows x86-64, macOS x86-64, or macOS ARM64.
On Unix systems, the malware writes a file to /tmp/rust- setup, marks it executable, and launches it as a detached background process. On Windows, it creates %TEMP% and uses a hidden
ust-setup.ps1wscript.exe and VBS launcher to maintain persistence. The payload receives an address as an argument, which researchers believe is a command-and-control server.
Infostealer Capabilities
Cloud security company Wiz analyzed the second-stage capabilities, which include exfiltrating host information and credentials from developer machines. The malware specifically targets browser-stored login data, querying SQLite databases from Google Chrome, Brave, and Microsoft Edge to extract saved credentials.
Persistence mechanisms vary by platform: the Registry Run key on Windows, LaunchAgent on macOS, and systemd on Linux. The attacker also published multiple versions of four additional crates—aovine, arone, aronenao, and tinymember—before they were removed from crates.io.
Scope and Impact
The scope of the attack is considerable. The arrayref crate alone has logged more than 245 million lifetime downloads, while append-only-vec and internment together account for nearly 19 million installs. Projects depending on arrayref include the blake3 hashing library, Rust GUI frameworks such as egui, eframe, and iced, and components used in Ethereum and Solana development.
Researchers at Wiz note that the campaign’s infrastructure overlaps with previously documented North Korean supply chain attacks, including those targeting the Mastra and axios ecosystems.
Recommendations
Developers who installed any of the affected packages during the exposure window should treat their systems as potentially compromised. Recommended checks include searching Cargo.lock files for the malicious packages, scanning for the dropped files described in the indicators of compromise, and reviewing network traffic to 23.254.165.112 on ports 9089 and 443.
Where compromise is confirmed, security teams should rotate all accessible credentials, CI tokens, signing keys, and other secrets, then rebuild development environments from known-clean backups. Unaffected projects should pin to a known-safe version of arrayref until the maintainer situation is fully clarified and resolved.
Cybersecurity firms StepSecurity, SafeDep, and Aikido have each published technical analyses and shared indicators of compromise for the attack.