{
  "id": 2395349,
  "title": "Hackers poison popular Rust crates to steal developers' credentials",
  "url": "https://urgent.news/2026/08/21/hackers-poison-popular-rust-crates-to-steal-developers-credentials",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-21T14:57:00.000Z",
  "source": {
    "name": "The Register",
    "slug": "the-register",
    "url": "https://www.theregister.com/security/2026/08/21/hackers-poison-popular-rust-crates-to-steal-developers-credentials/5291075"
  },
  "original_language": "en",
  "account": "Rust developers' credentials were stolen by hackers who injected malware into widely-used Rust packages, a supply chain attack disclosed this week. The Rust Security Response Team found the malware-laden build script in crate proc-macro1, which downloaded malicious code from a remote server during compilation. This attack affected other popular crates: arrayref, internment, and append-only-vec, all created by the same developer. The attacker deleted these legitimate crates, steering users towards malicious versions. The malicious code targeted developers' operating systems and processors, downloading unique payloads for Linux, Windows, Intel Macs, and Apple Silicon Macs. It also aimed to compromise Chromium-based browsers and cryptocurrency wallets, establishing persistence for future attacks. The Rust team, Nextron Systems, and security firm Aikido are investigating the extent of the damage and compromised systems.",
  "summary": "Malicious updates turned routine builds into a delivery system for infostealer malware",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register Science",
        "title": "Hackers poison popular Rust crates to steal developers' credentials",
        "url": "https://urgent.news/2026/08/21/hackers-poison-popular-rust-crates-to-steal-developers-credentials-2397935",
        "published": "2026-08-21T14:57:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}