Attackers compromised several widely used Rust programming packages this week, inserting malware that turned ordinary software builds into a method for stealing credentials from developers' computers. The Rust Security Response Team disclosed the supply chain attack on Thursday after receiving a tip about a suspicious crate called proc-macro1. An investigation revealed that the package's build script pulled malware from a remote server, compromising anyone who compiled code using the affected dependencies.
The attackers published a new version of arrayref, a legitimate and heavily downloaded Rust package, with proc-macro1 added as a dependency. They also removed recent legitimate releases of arrayref, pushing users toward the poisoned version. The same attacker released malicious versions of two other packages maintained by the same developer: internment and append-only-vec. The poisoned releases remained live on crates.io for 86 minutes (arrayref 0.3.10), 90 minutes (internment 0.8.7), and 107 minutes (append-only-vec 0.1.9) before removal. Security firm Aikido estimated arrayref has roughly 245 million lifetime downloads and append-only-vec has more than 4 million, though the number of developers who pulled the malicious versions during the brief window remains unknown.
The Rust team does not believe arrayref's maintainer was responsible, suspecting instead that the developer's computer or credentials were compromised. The team locked the account while attempting to reach the maintainer. Aikido found that the attacker largely preserved the legitimate source code, adding only a dependency on proc-macro1, a typosquat of the legitimate proc-macro2 package. Cargo, Rust's package manager, runs build scripts during compilation, which allowed proc-macro1 to identify the operating system and processor architecture, download a matching payload, and execute it. Aikido discovered malware built for Linux, Windows, Intel Macs, and Apple Silicon Macs.
The second-stage payload targeted Chromium-based browser data, including profiles for Google Chrome, Brave, and Microsoft Edge, as well as browser extension storage used by cryptocurrency wallets. Aikido also found functionality to establish persistence and receive commands from the attacker's server. The Rust team deleted proc-macro-en, aovine, arone, aronenao, and tinymember, warning that every version of those packages should be considered malicious. Developers have been urged to check their Cargo lockfiles and local registry caches for the affected packages, and the team credited Nextron Systems' research team with initially discovering and reporting the attack.
The malicious packages lasted less than two hours on crates.io, but the attackers chose a heavily trafficked route into developers' machines. The team has not disclosed how the legitimate maintainer was compromised, how many developers downloaded the poisoned releases, or how many systems ultimately executed the payload. The brief exposure window and the attackers' strategic removal of legitimate releases demonstrate a sophisticated understanding of the Rust package ecosystem and how developers discover and install dependencies. Organizations relying on open-source dependencies will need to balance speed of adoption with scrutiny of each update, a tension that becomes sharper as supply chain attacks grow more targeted and harder to detect.