The Arrayref Rust crate was compromised in a supply-chain attack that deployed infostealer malware on developers’ systems during compilation. Attackers also poisoned the append-only-vec and internment crates during the same short attack window.
Arrayref is a widely used Rust library with more than 53 million downloads in the past 90 days. It appears in cryptography, graphics and blockchain projects, making the incident a serious concern for developers and organisations that rely on Rust dependencies.
The malicious releases have since been removed. However, anyone who installed the affected packages during the exposure period should investigate for compromise.
Attackers used a typosquatted dependency
The attacker modified the affected releases by adding a dependency named proc-macro1. The package impersonated the legitimate and widely used proc-macro2 crate through a close spelling match.
The original source code in the compromised packages otherwise remained unchanged. This made the malicious addition harder to spot during a quick source review.
The proc-macro1 package included a build.rs script that ran automatically during compilation. The script reconstructed its infrastructure from encoded fragments and selected a payload that matched the developer’s operating system.
The malware supported Linux x86-64, Windows x86-64, macOS x86-64 and macOS ARM64 systems. That cross-platform support significantly increased the potential reach of the campaign.
Build-time malware steals data and establishes persistence
On Unix systems, the malware wrote a file named rust-setup to the temporary directory. It then marked the file as executable and launched it as a detached process.
On Windows, the payload created a PowerShell script in the temporary folder. It used hidden Windows Script Host and VBS components to keep the process running.
Researchers found that the second-stage payload could collect host details and steal credentials. It targeted browser login databases used by Chrome, Brave and Edge.
The malware also attempted to remain on infected systems. It used Registry Run keys on Windows, LaunchAgent entries on macOS and systemd services on Linux to establish persistence.
Arrayref Rust crate attack affected three packages
The malicious package releases included arrayref version 0.3.10, append-only-vec version 0.1.9 and internment version 0.8.7. All three packages were maintained through the same account.
The attacker also released several packages under separate names, including aovine, arone, aronenao and tinymember. The registry has removed those additional packages.
The campaign started early on August 20. Attackers created impersonating accounts before publishing an initially harmless proc-macro1 package. They then released a malicious update and pushed the poisoned crate versions through the compromised maintainer account.
The registry removed the malicious dependency and later removed arrayref 0.3.10 from its index. The overall exposure period lasted nearly 90 minutes.
Developers should treat affected builds as compromised
Developers should review Cargo.lock files and build records for the affected versions. They should also search systems for the dropped files and investigate network traffic linked to the campaign infrastructure.
Anyone who built a project during the exposure window should rotate accessible credentials, CI tokens, signing keys and other secrets. Teams should rebuild affected environments from known-safe backups after completing their investigation.
Projects that remain clean should pin known-safe dependency versions until the maintainer situation is fully resolved. Researchers have noted infrastructure overlap with recent North Korea-linked supply-chain campaigns, although this does not confirm attribution.
Conclusion
The Arrayref Rust crate compromise shows how a small dependency change can expose large parts of the software supply chain. Developers who installed the affected releases should assume risk, investigate their environments and rotate sensitive credentials immediately.
0 responses to “Arrayref Rust Crate Compromise Spreads Infostealer Malware”