A widely used Rust library, arrayref, was compromised through its maintainer account to distribute infostealer malware during compilation, affecting developers' systems. The attack, which occurred on August 20, also impacted two other crates, append-only-vec and internment, within a 23-minute window.
The arrayref crate, with over 53 million downloads in the past 90 days and 245 million lifetime downloads, is integral to various cryptography, graphics, and blockchain tools. Projects like blake3, Rust GUI frameworks egui, eframe, and iced, and components used in Ethereum and Solana all utilize arrayref. The collective download count for append-only-vec and internment is nearly 19 million.
The malicious releases were identified as arrayref 0.3.10, append-only-vec 0.1.9, and internment 0.8.7. The attacker injected a dependency on a package named proc-macro1, which is a typosquat of the legitimate proc-macro2 crate, while leaving the original source code of the compromised crates unchanged.
A script within proc-macro1, named build.rs, automatically executed during compilation. This script reconstructed its infrastructure from base64-encoded fragments and delivered a payload tailored to the host operating system, supporting Linux x86-64, Windows x86-64, macOS x86-64, and macOS ARM64.
On Unix systems, the malware wrote to /tmp/rust-setup, marked it executable, and launched it as a detached process. For Windows systems, it created %TEMP%\rust-setup.ps1 and used a hidden wscript.exe and VBS launcher to maintain persistence. The payload received an address as an argument, believed to be a command-and-control server.
Analysis of the second-stage capabilities revealed that the malware exfiltrated host information and credentials. It specifically targeted credentials from Google Chrome, Brave, and Edge browsers by querying their SQLite login databases. Persistence was established through the Registry Run key on Windows, LaunchAgent on macOS, and systemd on Linux.
The attack commenced at 01:17 UTC on August 20 with the creation of a GitHub account impersonating prominent Rust developer David Tolnay, followed by a similar account on the crates.io registry. At 01:55, the attacker published proc-macro1@1.0.106, initially a benign copy of proc-macro2. A malicious update, version 1.0.107, was published at 07:11.
At 07:15, arrayref 0.3.10 was published via the legitimate droundy (David Roundy) account. Versions 0.3.5 through 0.3.9 were simultaneously removed, potentially to force the installation of the malicious release. The incident was reported at 07:54. Crates.io subsequently deleted proc-macro1 at 08:03 and removed arrayref 0.3.10 from its index at 08:41. The attacker also published multiple versions of four other crates—aovine, arone, aronenao, and tinymember—which have since been removed from crates.io.
The campaign's infrastructure exhibits overlaps with recent North Korean supply chain attacks, including those known as Mastra and axios. Developers who installed any of the affected crates during the exposure window of approximately 1.5 hours should consider their systems compromised.
Recommended actions include checking Cargo.lock files, searching for the dropped files, and reviewing network traffic to 23.254.165[.]112 on ports 9089 and 443. If a compromise is confirmed, all accessible credentials, CI tokens, signing keys, and other secrets should be rotated, and the environment rebuilt from secure backups. For clean projects, it is advisable to pin a known-safe version of the affected dependencies until the maintainer situation is fully resolved.
