A Rust supply chain attack poisoned three legitimate crates on August 20, exposing developer workstations and continuous integration systems to malware that ran during compilation. Aikido Security and StepSecurity identified the malicious releases as arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9. The versions were removed from crates.io, but cached copies can remain on systems that resolved them during the exposure window.

The affected packages were published from an account belonging to their longtime maintainer. StepSecurity reported that the Rust Security Response Team assessed the account as compromised and locked it as a precaution. The three packages had about 264 million combined historical downloads, although that figure does not measure how many users downloaded the malicious versions during their brief availability.

Each poisoned release added a dependency on proc-macro1 1.0.107, a lookalike for the widely used proc-macro2 crate. According to both research teams, the dependency carried a build.rs script that Cargo automatically compiled and executed. That design meant a project only had to resolve and build an affected version; application code did not need to invoke the compromised library.

Aikido said the script selected a payload for Linux x86_64, Windows x86_64, macOS x86_64 or macOS Arm systems, downloaded it from 23[.]254[.]165[.]112 on port 9089 and launched it. Its analysis of recovered Linux and macOS samples found credential-stealing behavior aimed at Chromium-based browsers. The same address on port 443 was passed to the payload as command-and-control information.

StepSecurity placed the overall malicious-package exposure window between 07:11 and 09:25 UTC. It said arrayref 0.3.10 was available for 86 minutes before removal and that all three poisoned releases, the proc-macro1 and proc-macro-en droppers, and related attacker-controlled packages were deleted. The last safe versions listed by its investigation are arrayref 0.3.9, internment 0.8.6 and append-only-vec 0.1.8.

Defenders should search Cargo.lock files, vendored dependencies and Cargo registry caches for the affected names and versions. Systems that built them during the window should be isolated and investigated using available endpoint, process and network telemetry, with exposed credentials rotated from a clean device. Removing a release from crates.io prevents new retrievals but does not erase local caches or determine whether an earlier build executed the payload.