Rust Build Scripts Executed Malware From a Crate With 245 Million Downloads
TL;DR what: A compromised crates.io maintainer account published arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, each adding a single dependency on proc-macro1, a typosquat whose build script downloaded and executed a remote payload at compile time. impact: arrayref has 245,385,500 all time downloads and 403 dependent crates, and the stage 2 implant persists on Windows, macOS, and…
A compromised maintainer account on crates.io published malicious versions of three Rust crates on August 20, 2026, including arrayref, internment, and append-only-vec. These crates added a dependency on proc-macro1, a typosquat of the common proc-macro2 crate. The malicious build scripts executed remote payloads at compile time, persisting on Windows, macOS, and Linux systems and stealing browser credentials from Chrome, Brave, and Edge.
The arrayref crate, which has 245,385,500 total downloads, was compromised with version 0.3.10, which was deleted 86 minutes after publication. There is no CVE or patched release, so developers must pin their arrayref dependency at version 0.3.9 or earlier, purge their cache, and block specific crate names to mitigate the threat.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
