The Rust Security Response Team has disclosed a supply chain attack that injected malware into several popular Rust packages, turning routine software builds into a mechanism for delivering infostealer malware to developers' machines. The incident was initially reported to the Rust team by Nextron Systems' research team.
The attack began with a malicious crate named `proc-macro1`. An investigation revealed that this crate's build script was designed to fetch malware from a remote server. Further analysis showed that an attacker had published a new, compromised version of `arrayref`, a widely used Rust package, by adding `proc-macro1` as a dependency. The attacker also removed recent legitimate releases of `arrayref` from the registry, effectively directing users toward the poisoned version.
The Rust team suspects the maintainer of `arrayref` was not directly responsible but rather had their computer or credentials compromised. The team has since locked the maintainer's account and is attempting to establish contact. The same attacker also published malicious versions of two other crates maintained by the same developer: `internment` and `append-only-vec`.
The poisoned releases were available on crates.io for a limited time. `Arrayref` version 0.3.10 was live for 86 minutes, `internment` version 0.8.7 for 90 minutes, and `append-only-vec` version 0.1.9 for 107 minutes before they were removed. Despite this narrow window, these packages are widely used; security firm Aikido estimates `arrayref` has approximately 245 million lifetime downloads and `append-only-vec` over 4 million. The exact number of developers who downloaded the malicious versions during their brief availability is not yet known.
Aikido's analysis confirmed that the attacker largely left the legitimate source code of the compromised packages untouched, primarily adding a dependency on `proc-macro1`. This `proc-macro1` crate is a typosquat of the legitimate `proc-macro2` package. The malicious code was embedded within `proc-macro1`'s `build.rs` file. Rust's package manager, Cargo, executes build scripts during compilation, which allowed `proc-macro1` to identify the operating system and processor architecture of the developer's or build machine. It then downloaded and executed a matching payload. Aikido identified malware payloads designed for Linux, Windows, Intel Macs, and Apple Silicon Macs.
The second-stage payload was a sophisticated infostealer. Aikido found code specifically targeting data from Chromium-based browsers, including profiles for Google Chrome, Brave, and Microsoft Edge. It also targeted browser extension storage, particularly that used by cryptocurrency wallets. Additionally, the malware included functionality to establish persistence on compromised systems and receive commands from the attacker's server.
In addition to the aforementioned packages, the Rust team also deleted `proc-macro-en`, `aovine`, `arone`, `aronenao`, and `tinymember` from the registry, advising that all versions of these crates should be considered malicious. Developers are urged to inspect their Cargo lockfiles and local registry caches for any of the affected packages. The Rust team has not yet disclosed how the legitimate maintainer was compromised or the total number of systems that executed the malicious payload.
