Attackers slipped credential-stealing malware into three popular Rust packages this week by compromising a legitimate maintainer's account. The poisoned versions of arrayref, internment, and append-only-vec were live on crates.io for less than two hours before the Rust Security Response Team pulled them. But arrayref alone has 245 million lifetime downloads, making even that narrow window dangerous.
The attack worked by adding a single malicious dependency. Someone published a typosquat crate called proc-macro1, mimicking the widely used proc-macro2. Then they pushed new versions of the three legitimate packages with proc-macro1 listed as a dependency. To push developers toward the poisoned releases, the attacker yanked recent legitimate versions of arrayref.
How the payload reached developer machines
Top 10 Rust crates you must know
Cargo, Rust's package manager, runs build scripts during compilation. The attacker hid malicious code inside proc-macro1's build.rs file. When a developer's build process pulled the dependency, the script identified the operating system and processor architecture, downloaded a matching payload from a remote server, and executed it.
Security firm Aikido analyzed the malware and found binaries compiled for Linux, Windows, Intel Macs, and Apple Silicon Macs. The second-stage payload targeted Chromium-based browsers, including Chrome, Brave, and Edge, harvesting profiles and extension storage. Cryptocurrency wallet extensions were a specific target. The malware also established persistence and opened a command channel to the attacker's server.
What the Rust team found
The Rust Security Response Team disclosed the attack Thursday after receiving a tip about proc-macro1. They traced the problem to a compromised maintainer account and locked it while trying to reach the developer. The team does not believe the maintainer was responsible.
Beyond the three hijacked packages, the team also deleted proc-macro-en, aovine, arone, aronenao, and tinymember from crates.io, warning that every version of those crates should be considered malicious. Nextron Systems' research team discovered and reported the attack.
The Rust team has not disclosed how the maintainer's credentials were compromised, how many developers pulled the malicious versions, or how many machines actually executed the payload.
What affected developers should do
Developers should check their Cargo.lock files and local registry caches for any of the affected packages. The poisoned versions are arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9. Any presence of proc-macro1, proc-macro-en, aovine, arone, aronenao, or tinymember warrants immediate investigation.
If your build pulled any of these, assume compromise. Rotate browser-stored credentials, check cryptocurrency wallets for unauthorized activity, and audit the affected system for persistence mechanisms.
Logicity's Take
This attack exploited a structural weakness in how Cargo handles build scripts. Supply chain security tools like Snyk, Socket.dev, and Phylum can flag suspicious dependencies before they reach your build. For high-value targets, consider running builds in isolated environments and blocking network access during compilation. The 90-minute window shows attackers know exactly how fast detection catches up.
The broader pattern
This is not the first time package registries have been weaponized. npm, PyPI, and now crates.io have all seen typosquatting and maintainer compromise attacks. The difference here is speed. The attacker moved fast, targeting a high-download package with a credential-stealing payload that worked across four platforms.
The Rust ecosystem has historically benefited from a reputation for safety. That reputation applies to memory safety in the language itself, not to the package registry. Crates.io, like any public repository, depends on maintainer security practices. One compromised developer machine can turn a trusted package into an attack vector.
Credential theft often begins with compromised developer workstations
Need Help Implementing This?
Logicity helps enterprises assess supply chain security posture and implement dependency monitoring. Contact us for a security review.
Source: www.theregister.com
Huma Shazia
Senior AI & Tech Writer
Produced with AI assistance and reviewed by the Logicity editorial team. Learn more in our Editorial Policy.
