● Covered by 5 sources · 5 reportsMedium impact5 negative
Malicious `proc-macro1` crate leads to supply chain attack on `arrayref` and other Rust crates
Key points
- Malicious `proc-macro1` crate downloaded a malicious payload.
- `arrayref`, `internment`, `append-only-vec` were compromised.
- Malicious versions were online for 86 to 107 minutes.
- Rust Security Response Team removed malicious crates and locked accounts.
- Malicious `arrayref` version 0.3.10 was published.
- Compromised `arrayref` and `append-only-vec` crates were maintained by droundy.
- The `proc-macro1` crate was published by dtolney.
- The `proc-macro1` metadata forged David Tolnay as author.
- Malicious versions were published within a 23-minute window.
- Malicious `append-only-vec` version 0.1.9 was published.
- Malicious `internment` version 0.8.7 was published.
- The `proc-macro1` crate contained a `build.rs` script.
- The `build.rs` script reconstructed infrastructure from base64-encoded fragments.
- The `build.rs` script selected a payload matching the host OS.
- Malicious versions were published on August 20, 2026.
- The malicious code was in the build script of the injected dependency.
- Building a project that resolved the dependency was sufficient to run the payload.
- Developers should search ~/.cargo/registry/cache for deleted crate files.
- Developers should pin arrayref at 0.3.9 or earlier.
- No patched version exists for the affected crates.
- No CVE identifier has been assigned.
- No evidence exists that any malicious version was used.
- North Korean threat actor Sapphire Sleet executed the attack.
- Cybersecurity firm Wiz reported the attack.
- The `arrayref` crate has over 245 million downloads.
- The `arrayref` crate is found in approximately 75% of Rust environments.
- Malicious versions of `internment` and `append-only-vec` were released 20 minutes after `arrayref`.
- Attacker-owned crates `aovine`, `arone`, `aronenao`, `tinymember` referenced the malicious dependency.
- The malicious dependency `proc-macro1` impersonated `proc-macro2`.
- The `build.rs` script disabled certificate validation.
Malicious Crate Discovery
On August 20, 2026, the Rust Security Response Team received a report regarding the `proc-macro1` crate containing malicious code. Investigation confirmed that the crate's build script was designed to download a malicious payload. Several other related crates, including `proc-macro-en`, `aovine`, `arone`, `aronenao`, and `tinymember`, were also identified as malicious and subsequently deleted from crates.io.
Supply Chain Compromise
Further analysis revealed that the widely used `arrayref` crate had been republished with a dependency on the malicious `proc-macro1` crate. The compromised versions of `arrayref` were yanked, and the Rust team restored the legitimate versions. Other crates from the same author, `internment` and `append-only-vec`, were similarly affected. The author's account was locked as a precautionary measure, as their credentials or computer were likely compromised, though the author is not believed to be malicious.
Affected Versions and Remediation
The malicious versions removed include `append-only-vec@0.1.9` (online for 107 minutes), `arrayref@0.3.10` (online for 86 minutes), and `internment@0.8.7` (online for 90 minutes). All versions of `proc-macro1`, `proc-macro-en`, `aovine`, `arone`, `aronenao`, and `tinymember` were also deleted. Developers are advised to check their local dependencies to ensure these malicious crates were not pulled into their projects. A command-line utility was provided to assist in this verification process.
Industry Impact
This incident underscores the ongoing threat of supply chain attacks within the software ecosystem. The compromise of popular crates, even for a short duration, can lead to widespread security vulnerabilities in downstream projects. The swift response by the Rust Security Response Team mitigated the potential damage, but it serves as a reminder for continuous vigilance in dependency management and security practices.
Updates
- North Korean threat actor Sapphire Sleet executed the attack.
- Cybersecurity firm Wiz reported the attack.
- The `arrayref` crate has over 245 million downloads.
- The `arrayref` crate is found in approximately 75% of Rust environments.
- Malicious versions of `internment` and `append-only-vec` were released 20 minutes after `arrayref`.
- Attacker-owned crates `aovine`, `arone`, `aronenao`, `tinymember` referenced the malicious dependency.
- The malicious dependency `proc-macro1` impersonated `proc-macro2`.
- The `build.rs` script disabled certificate validation.
- Malicious versions were published on August 20, 2026.
- The malicious code was in the build script of the injected dependency.
- Building a project that resolved the dependency was sufficient to run the payload.
- Developers should search ~/.cargo/registry/cache for deleted crate files.
- Developers should pin arrayref at 0.3.9 or earlier.
- No patched version exists for the affected crates.
- No CVE identifier has been assigned.
- No evidence exists that any malicious version was used.
- Malicious versions were published within a 23-minute window.
- Malicious `append-only-vec` version 0.1.9 was published.
- Malicious `internment` version 0.8.7 was published.
- The `proc-macro1` crate contained a `build.rs` script.
- The `build.rs` script reconstructed infrastructure from base64-encoded fragments.
- The `build.rs` script selected a payload matching the host OS.
- Malicious `arrayref` version 0.3.10 was published.
- Compromised `arrayref` and `append-only-vec` crates were maintained by droundy.
- The `proc-macro1` crate was published by dtolney.
- The `proc-macro1` metadata forged David Tolnay as author.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub rust-lang/blog.rust-lang.org GitHub safedep/vet GitHub safedep/pmg GitHub safedep/xbom GitHub safedep/gryph GitHub rustsec/advisory-dbHow outlets covered it
North Korean threat actor Sapphire Sleet executed a supply chain attack on the Rust ecosystem by pushing malicious versions of popular crates like arrayref to crates.io. The attack involved compromising a legitimate maintainer's account and injecting a dependency that fetched a second-stage binary, though the Rust Security Response Team removed the malicious packages within 86 minutes, finding no evidence of actual usage.
The Rust Project removed malicious versions of three popular crates (arrayref, internment, append-only-vec) from crates.io after a compromised maintainer account published releases containing a typosquatted dependency that executed a remote payload during compilation. This incident highlights ongoing supply chain security risks in package ecosystems, where compromised accounts can quickly distribute malware to downstream projects.
Hackers compromised the maintainer account for the popular Rust crate 'arrayref' and two other crates, 'append-only-vec' and 'internment', injecting infostealer malware into developers' systems during compilation. This supply-chain attack is significant due to the widespread use of 'arrayref' in critical projects, potentially exposing numerous development environments to credential theft.
A compromised version 0.3.10 of the popular Rust crate 'arrayref' was published on crates.io, including a dependency on a malicious typosquatted crate 'proc-macro1'. This dependency's build script downloaded and executed a remote binary during project compilation, affecting any project that pulled the compromised 'arrayref' version. The crates.io team has since removed the malicious versions.
The Rust Security Response Team identified and removed several malicious crates, including `proc-macro1`, which was used in a supply chain attack to compromise popular crates like `arrayref`, `internment`, and `append-only-vec`. This incident highlights the vulnerability of software supply chains to malicious package injections and necessitates developers to verify their dependencies.