Rust Supply Chain Attack Puts Build-Time Malware in 245M-Download Crates
The Rust Project has confirmed a supply chain attack targeting three widely used crates on crates.io, with combined download counts exceeding 245 million. On August 20, 2026, a compromised maintainer account published malicious versions of arrayref (0.3.10), internment (0.8.7), and append-only-vec (0.1.9), each injecting a typosquatted dependency called proc-macro1, a deliberate misspelling of the ubiquitous proc-macro2 crate. The injected package contained a build script that downloaded and executed a remote payload during compilation, meaning any developer who simply built a project resolving the affected dependency would have triggered the malware without ever importing or calling the crate itself. The Rust Security Response Team credited the Research Team at Nextron Systems GmbH with discovering and reporting the threat at 07:15 UTC.
According to timeline data published in advisories RUSTSEC-2026-0260, RUSTSEC-2026-0261, and RUSTSEC-2026-0262, each malicious release was live for between 86 and 107 minutes before being yanked and deleted from the registry. The sole listed owner of the arrayref crate is user 2402, registered to David Roundy in October 2009, though the Rust Security Response Team stated that "we do not believe the author of arrayref to be acting maliciously, but their computer or credentials are likely compromised." The exact vector of the account compromise has not been disclosed. Developers are advised to scan their ~/.cargo/registry/cache directories for the affected crate files and pin arrayref at version 0.3.9 or earlier. Anyone investigating the domains involved in such incidents can use our WHOIS lookup tool to verify registration details, and our SSL/TLS checker can help validate the integrity of any fetched build artifacts.
Other crates flagged as malicious in the same operation include proc-macro1, proc-macro-en, aovine, arone, aronenao, and tinymember, all of which should be treated as dangerous in any version. The Rust Security Response Team unyanked the maliciously-yanked legitimate versions during the response so pinned projects would still resolve, but no patched versions of the three primary crates exist, and no CVE identifier has been assigned. The official advisories record "no evidence that any malicious version was used," yet because the payload executed at build time, the absence of observed impact does not rule out successful compromise on developer workstations and CI runners. Security teams should audit recent build pipelines for unusual outbound connections and rotate any credentials present on machines that compiled Rust projects during the affected window. Use our password checker to evaluate the strength of any credentials that may have been exposed on compromised build hosts.
The incident underscores the persistent risk that supply chain attacks pose to open-source ecosystems, particularly when malicious code is triggered by the build process itself rather than requiring runtime execution. Build-time payloads are especially dangerous in CI/CD environments where builds frequently run with elevated privileges and access to production secrets. The Rust Security Response Team is coordinating with the affected maintainer to restore account security and is encouraging all crate publishers to enable two-factor authentication on their crates.io accounts as a baseline defense.