Hackers poison arrayref Rust crate to push infostealer malware
Hackers hijacked the maintainer account of the popular Rust crate arrayref to inject malware that executed on developers' systems during compilation.
Source: BleepingComputer · August 20, 2026 at 6:01 PM · AI-assisted report
Single-source
KUALA LUMPUR, 21 AUGUST 2026 —
Listen to this article
DomainFork Audio · read aloud
Hackers hijacked the maintainer account of the popular Rust crate arrayref to inject malware that executed on developers' systems during compilation.
Market Impact
The 23-minute attack on August 20 also poisoned two adjacent crates, append-only-vec and internment, according to security firm StepSecurity.
Arrayref alone has more than 53 million downloads in the last 90 days and 245 million lifetime installs, while append-only-vec and internment have nearly 19 million installs combined.
The poisoned releases—arrayref 0.3.10, append-only-vec 0.1.9, and internment 0.8.7—were uploaded between 07:15 and 07:54 UTC and later removed after a report at 07:54.
The attacker first published proc-macro1@1.0.106, a benign copy of the legitimate proc-macro2 crate, at 01:55 UTC, then a malicious update as version 1.0.107 at 07:11.
StepSecurity says the rogue build.rs script in proc-macro1 base64-decodes its infrastructure and selects a payload tailored to the host operating system—Linux x86-64, Windows x86-64, macOS x86-64, or macOS ARM64.
On Unix systems the malware writes /tmp/rust-setup, marks it executable, and launches it as a detached process; on Windows it creates %TEMP%\rust-setup.ps1 and uses wscript.exe to stay resident.
Cloud security firm Wiz reports the second-stage payload exfiltrates host information and browser credentials harvested from Chrome, Brave, and Edge via SQLite login databases.
Persistence is set through the Windows Registry Run key, macOS LaunchAgent, or Linux systemd, and the malware reaches out to 23.254.165[.]112 on ports 9089 and 443.
The exposure window lasted about 1.5 hours. Developers who installed any of the poisoned versions during that period should rotate all accessible credentials, CI tokens, and signing keys.
Projects known to depend on arrayref include the blake3 cryptographic library, Rust GUI frameworks egui, eframe, and iced, and components used in Ethereum and Solana.
StepSecurity says the attacker also published four new crates—aoavine, arone, aronenao, and tinymember—which were removed from crates.io.
Cybersecurity companies StepSecurity, SafeDep, and Aikido each published technical notes and indicators of compromise.
Wiz researchers note the campaign’s infrastructure overlaps with recent DPRK supply-chain attacks, including Mastra and axios.
The incident highlights the risks of typosquatting and dependency confusion in software supply chains.
Related: Google