> ## Content Index
> Fetch the complete content index at: https://www.thecybersignal.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Rust Pulls 3 Poisoned crates.io Packages After a Build-Time Malware Supply-Chain Attack
- URL: https://www.thecybersignal.com/rust-cratesio-supply-chain-245m-downloads-typosquat-2026/
- Published: 2026-08-21T21:57:00.000Z
- Updated: 2026-08-22T13:01:22.000Z
- Description: The Rust Project deleted malicious releases of arrayref, internment, and append-only-vec from crates.io after a compromised maintainer account added a typosquatted proc-macro1 dependency whose build script ran malware at compile time. Here is what security teams should check.
- Author: Nicholas Robert
- Tags: Supply Chain Attack, Open Source Security, Developer Tools

The Rust Project deleted malicious versions of three widely used crates from [crates.io](https://crates.io/?ref=thecybersignal.com) on August 20, 2026, after a compromised maintainer account published releases that quietly added a typosquatted dependency whose build script downloaded and ran malware during compilation.

The poisoned releases were arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, all pushed from the same owner account and all pulled within 86 to 107 minutes, [The Hacker News reported](https://thehackernews.com/2026/08/rust-supply-chain-attack-puts-build.html?ref=thecybersignal.com). The largest of the three, arrayref, carries roughly 245 million all-time downloads (245,385,500 as of an August 21 crates.io check, with about 53.9 million in the prior 90 days), which is why an incident that lasted under two hours still rattled the ecosystem. There is no CVE, no patched version, and, per the Rust Security Response Team, no evidence that any malicious version was actually pulled into a build in the wild.

What makes this one worth a defender's attention is not the download count. It is the delivery mechanism. The malicious code never lived in the crates themselves. It lived in the build script of a dependency they pointed at, which means the payload ran during `cargo build`, before a single line of the trusted library was ever called.

## What Actually Shipped

Each of the three compromised releases carried one added line in its manifest: a dependency on a crate called proc-macro1, a typosquat of the ubiquitous proc-macro2 by David Tolnay. The source of proc-macro1 was a genuine copy of proc-macro2, so builds completed normally and nothing looked broken. The malice sat entirely in that dependency's build script.

Build scripts (the `build.rs` file Cargo compiles and runs before your crate) are ordinary Rust programs with full access to the machine. Cargo runs them automatically. According to the RustSec advisory database [report filed by the researcher who hit it](https://github.com/rustsec/advisory-db/issues/3161?ref=thecybersignal.com), the script rebuilt a payload host and command-and-control address from base64 fragments at build time, disabled TLS certificate validation, then fetched and ran a second-stage binary chosen by operating system and CPU architecture. The Nextron analysis referenced in that thread notes the trigger fires on `cargo build`, `cargo check`, and `cargo test`. I am deliberately not reproducing the payload logic here; the point for defenders is the trigger, not the recipe.

The lure was quiet and clever. According to the same report, versions 0.3.5 through 0.3.9 of arrayref were yanked from the owner account in the same minute the malicious 0.3.10 went up, so the poisoned release became the only recent version Cargo would not flag with its "consider updating to a version that is not yanked" warning. As the reporter, GitHub user jhobern, put it: "Delivery: 0.3.5–0.3.9 are all yanked under the owner account, so cargo's `consider updating to a version that is not yanked` warning is the lure. That is how I hit it."

| ● How A Build-Time Crate Compromise Spreads One added dependency line was enough to run code during compilation, before any crate function was called.                                                             |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Step 1 · Trusted Account, Abused A compromised maintainer account publishes new releases of three legitimate, widely used crates.                                                                                  |
| ↓                                                                                                                                                                                                                  |
| Step 2 · One Line Added Each release adds a single manifest line: a dependency on proc-macro1, a typosquat of the trusted proc-macro2.                                                                             |
| ↓                                                                                                                                                                                                                  |
| Step 3 · Code Runs At Build Time The dependency ships a build script. Running cargo build, check, or test executes it and pulls a remote payload. No crate function has to be called.                              |
| ↓                                                                                                                                                                                                                  |
| Step 4 · Wide Reach By Default arrayref sits beneath many popular crates through caret version ranges, so a routine build could resolve the poisoned 0.3.10 without anyone asking for it.                          |
| Diagram: The CyberSignal. Conceptual flow reconstructed from the Rust Security Response Team advisory, RUSTSEC-2026-0260, and The Hacker News (August 2026). Defender-oriented, not a reproduction of the payload. |

## Why Build-Time Is the Dangerous Part

Most developers reason about dependencies as code they choose to call. A build-script compromise breaks that mental model. You do not have to import the crate, invoke its functions, or ship the resulting binary for the malware to run. Resolving the dependency and building the project is enough, and that happens the moment a developer or a CI runner types `cargo build`. This is the same reason build-time execution keeps showing up in package-registry attacks: it runs early, it runs automatically, and it runs with whatever privileges the build environment has.

It also widens the pool of victims well past the direct users of arrayref. Because Cargo resolves transitive dependencies, a project that never names arrayref in its own manifest can still pull it in through something else, and if the version requirement is a caret range on the 0.3.x line, it accepts 0.3.10\. The Hacker News traced one such chain against the crates.io index: winit requires sctk-adwaita, which requires tiny-skia, which requires arrayref at `^0.3.6`, a range that would have accepted the poisoned release.

## How Big Was the Blast Radius

On paper, large. Beyond arrayref's roughly 245 million downloads and its 403 direct dependents, arrayref sits underneath widely used projects including winit, egui, iced, and blake3, plus crates tied to the Solana and Ethereum ecosystems. That is the population that could, in principle, have resolved a poisoned build during the window the releases were live.

In practice, the damage looks contained. The malicious versions were online for 86 to 107 minutes, and the Rust Security Response Team says it found no evidence any of them were used. The team also moved fast on the dependency graph: maintainers of blake3, blake2b\_simd, and blake2s\_simd dropped their arrayref dependency in releases published within a few hours that same morning, per The Hacker News. Short window plus no observed usage is the best-case version of a story that could have been much worse.

## The Response, and What Rust Is and Isn't Shipping

The Rust Security Response Team said it received a report at 07:15 UTC that proc-macro1 was malicious, credited the Research Team at Nextron Systems with the initial discovery, and yanked the three releases inside roughly two hours, laying out the timeline in its [advisory post](https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/?ref=thecybersignal.com). The [RUSTSEC-2026-0260 advisory](https://rustsec.org/advisories/RUSTSEC-2026-0260?ref=thecybersignal.com) records it plainly: "A new version of the arrayref crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. This compromised version was published on 2026-08-20 and removed approximately 86 minutes later, with no evidence of actual usage."

One wrinkle worth flagging for anyone scripting a cleanup: during the response the team unyanked the previously yanked good versions, so pinning arrayref at 0.3.9 or earlier is once again a clean choice rather than a yanked one.

The structural gap is that Cargo still has no built-in cooling window for freshly published dependencies. A pull request that would stabilize a [global-min-publish-age setting](https://github.com/rust-lang/cargo/pull/17335?ref=thecybersignal.com), which holds back dependencies younger than a configured age, entered its final comment period on August 18, two days before this attack, and remained open and unmerged as of August 21\. Other ecosystems have started shipping exactly this kind of speed bump. We covered GitHub's move to add a [three-day Dependabot cooldown](https://www.thecybersignal.com/github-dependabot-cooldown-pypi-upload-rule-supply-chain-2026/) earlier this summer. A cooling window would not have blocked a compromise that relied on republishing a trusted name, but it buys defenders time for exactly this scenario: a bad version that gets caught and pulled within hours.

## Who Is Behind It

Attribution is unsettled, and I want to be precise about what is and is not confirmed. The second-stage implant behaves like an infostealer: [Wiz reports](https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns?ref=thecybersignal.com) it steals browser credentials from Chrome, Brave, and Edge and beacons to a command-and-control server. No vendor has published a named malware family for the crates.io payload, and no vendor has attributed this specific incident to a named threat actor. What Wiz does say is that the infrastructure substantially overlaps with recent North Korean supply-chain operations, naming the [Mastra npm compromise](https://www.thecybersignal.com/microsoft-mastra-npm-sapphire-sleet-attribution-2026/) (which Microsoft ties to Sapphire Sleet) and the [axios npm compromise](https://www.thecybersignal.com/aws-north-korea-axios-npm-supply-chain-attribution-2026/) (attributed by Google to an actor it tracks as MIDNIGHT NEPTUNE). Overlap is a lead, not a verdict.

On the maintainer: The Hacker News confirmed via the crates.io API that the sole listed owner of arrayref is David Roundy, and the Rust Security Response Team was careful in its wording. "We do not believe the author of arrayref to be acting maliciously, but their computer or credentials are likely compromised, and we are attempting to contact them," the team said. How the account was compromised has not been disclosed. There are no publicly named victims.

## What Defenders Should Do Now

This is a build-system exposure, so the checks live in your toolchains and pipelines, not just your running services.

- **Audit Cargo.lock and cached crates.** Search build hosts and developer machines for the pulled files under `~/.cargo/registry/cache`, and grep lockfiles for arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9, and any of proc-macro1, proc-macro-en, aovine, arone, aronenao, or tinymember.
- **Pin to known-good versions.** Pin arrayref at 0.3.9 or earlier (now unyanked), and replace any caret range that could float a dependency into a just-published release.
- **Review build-script activity.** Treat `build.rs` in your dependency tree as executable code. Flag build scripts that reach the network, decode strings at build time, or disable TLS verification.
- **Inspect CI/CD logs for build-time network calls.** Anomalous outbound connections during `cargo build`, `cargo check`, or `cargo test` are the tell here. Alert on builds that fetch and execute files from unexpected hosts.
- **Build with `--frozen` or `--locked`.** In CI, these flags make Cargo refuse to change the lockfile, so a run cannot silently resolve a newer, poisoned version out from under you.
- **Consider a cooling window on new dependency versions** where your tooling supports it, so a release caught within hours never reaches your builders in the first place.

**My read:** This is an assessment, not a reported fact. The download headline is doing a lot of work in the coverage, but the number that should worry a security team is the one nobody is quoting: minutes of exposure against how many CI runners fire on every push. The registry defenders did their job in under two hours. The uncomfortable part is that build-script execution turns "we build on every commit" into "we execute newly published third-party code on every commit," and most pipelines are not watching the network during a build. Fix that visibility gap now, because the next crate to get republished may not be caught in 86 minutes.

*Updated August 21, 2026: Reflects the Rust Security Response Team advisory, RUSTSEC-2026-0260, and reporting through August 21.*

### Primary Documents

- [Rust Security Response Team advisory: Supply chain attack on arrayref](https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/?ref=thecybersignal.com)
- [RUSTSEC-2026-0260 advisory (arrayref)](https://rustsec.org/advisories/RUSTSEC-2026-0260?ref=thecybersignal.com)
- [RustSec advisory-db issue #3161 (initial report and delivery detail)](https://github.com/rustsec/advisory-db/issues/3161?ref=thecybersignal.com)
- [The Hacker News: Rust Supply Chain Attack Puts Build-Time Malware in Crates With 245 Million Downloads](https://thehackernews.com/2026/08/rust-supply-chain-attack-puts-build.html?ref=thecybersignal.com)
- [Wiz: arrayref supply-chain attack and DPRK campaign overlap](https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns?ref=thecybersignal.com)