XHack
Author
Table of Contents
11
Read this in 30 seconds: This Rust supply chain attack happened on August 20, 2026, when attackers compromised the maintainer account behind three popular Rust crates, arrayref, internment, and append-only-vec, and published versions carrying a dependency on a typosquatted package whose build script silently downloaded and ran malware the moment a project compiled. arrayref alone has 245 million all-time downloads and sits underneath Solana, Ethereum, and dozens of other widely used crates.
The Rust Security Response Team pulled the malicious versions within roughly 86 to 107 minutes of publication, and Wiz has since found infrastructure overlap with North Korea’s Sapphire Sleet campaign. If your lockfile resolved arrayref 0.3.10, internment 0.8.7, or append-only-vec 0.1.9 on August 20, check your cache now.
You do not have to run untrusted code to get owned anymore. You just have to build it, and that is the whole story of this Rust supply chain attack.
That is the uncomfortable lesson from this Rust supply chain attack, and it is why it deserves attention even if you have never written a line of Rust. The malicious crate’s own functions never needed to be called. Compiling the project was the entire attack.
On August 20, 2026, someone gained access to the crates.io account of the maintainer behind three legitimate, widely used Rust crates, arrayref, internment, and append-only-vec. The Rust Project’s own postmortem says plainly that the maintainer’s “computer or credentials are likely compromised,” not that the maintainer went rogue.
Using that access, the attacker ran the Rust supply chain attack by publishing new versions, most critically arrayref 0.3.10, that added a dependency on proc-macro1, a typosquat of David Tolnay’s real and hugely popular `proc-macro2` crate. `proc-macro1`’s `build.rs` script decoded an attacker address from base64, downloaded a second-stage binary over TLS with no certificate validation, and executed it, on Linux, Windows, Intel Macs, and Apple Silicon Macs, according to malware researchers at Aikido.
Here is the timeline straight from the Rust Project’s own advisory: the Security Response Team received a report at 7:15 UTC, the malicious versions had gone up between 7:15 and 7:37 UTC, and every affected package was identified and removed from crates.io between 8:41 and 9:25 UTC. Total window of exposure: roughly 86 to 107 minutes.
Most supply chain attacks need you to actually call the compromised code path. This one did not.
`build.rs` scripts run automatically as part of `cargo build`, before a single line of your actual application logic executes. Simply having arrayref 0.3.10 resolved in your lockfile and running a normal build was enough to detonate the payload. You did not need to use the crate’s functions. You did not need to run the finished binary. You needed to compile.
That is what made this dangerous at scale. arrayref carries 245 million all-time downloads, about 53.7 million in the last 90 days alone, and sits as a direct dependency for 403 other crates, including foundational projects like winit, egui, iced, and blake3. internment and append-only-vec are smaller but still meaningful, at roughly 14.4 million and 4.5 million all-time downloads.
Once running, the second-stage payload went straight for the highest-value targets on a developer’s machine. Researchers at Aikido found code specifically targeting Chromium-based browser data, Chrome, Brave, and Microsoft Edge profiles, along with browser extension storage used by cryptocurrency wallets. It also established persistence and phoned home for further commands.
Solana and Ethereum tooling both depend on arrayref transitively, which means the attack sat one step away from exactly the audience most likely to have valuable browser-extension crypto wallets open on the same machine they were compiling code on.
This is the part most coverage buried, and it is the part that changes how seriously you should take it.
Wiz’s analysis found the payload beaconing to a command-and-control endpoint that has already been tied to the Mastra campaign, which Microsoft has publicly attributed to DPRK-linked group Sapphire Sleet. The infrastructure overlap goes deeper: a shared SSL certificate issuer with IPs used in the Mastra campaign, and a victim-reported C2 IP that also shows up in Google Cloud Threat Intelligence’s analysis of a separate North Korea-linked npm attack on the `axios` package, attributed by Mandiant to a group tracked as UNC1069. Both incidents lean on the same `23.254.164.0/23` Hostwinds LLC IP range.
That is not a smoking gun on its own, infrastructure gets reused and sold, but it is a consistent enough pattern that treating this as an isolated, low-stakes incident would be a mistake. State-linked actors are running supply chain attacks against language-package ecosystems as a standing line of business, not a one-off.
If you build Rust projects, or depend on anyone who does, take five minutes:
Supply chain attacks that fire during the build step, not the run step, are becoming the preferred technique precisely because they bypass the mental model most developers still use: “I’ll review the code before I run it.” Nobody reviews a `build.rs` script line by line before every `cargo build`. Attackers know that.
A Rust supply chain attack like this one is also exactly the kind of exposure that automated, continuous scanning catches before a human ever would. XHack’s GitGuard scans every pull request for exactly this class of issue, suspicious new dependencies and build-time code execution, before it merges into your main branch, and it does not store the data it scans. If you are relying on annual reviews to catch a threat that can weaponize in under two hours, the review cadence itself is the vulnerability.
Three legitimate crates were compromised: `arrayref` (version 0.3.10), `internment` (version 0.8.7), and `append-only-vec` (version 0.1.9). All three were published from the same compromised maintainer account on August 20, 2026, and all were removed from crates.io within 86 to 107 minutes.
No. The malicious payload executed via a `build.rs` script during `cargo build`, before your application code ever ran. Simply compiling a project that resolved the malicious crate versions was enough to trigger the payload on Linux, Windows, and Mac.
Wiz found infrastructure overlap, a shared command-and-control endpoint and SSL certificate details, with the Mastra campaign, which Microsoft has attributed to the North Korea-linked group Sapphire Sleet. It is not definitive proof, but it is a consistent pattern with other documented DPRK supply chain operations.
A compromised maintainer account, a one-character typosquat, and a build script were enough to put credential-stealing malware in front of tens of millions of Rust developers, cryptocurrency-adjacent tooling included, before most people finished their coffee. The Rust Project’s response, under two hours from tip to takedown, was genuinely fast. The exposure window still existed, and the next one might not close as quickly.
Check your lockfiles today.
Related articles
Read this in 30 seconds: A phishing toolkit called iAuthFlow V2, selling for roughly $10,000 on Russian-language cybercr...
Read this in 30 seconds: On August 18, 2026, CISA added four vulnerabilities to its Known Exploited Vulnerabilities cata...
