{
  "id": 2397935,
  "title": "Hackers poison popular Rust crates to steal developers' credentials",
  "url": "https://urgent.news/2026/08/21/hackers-poison-popular-rust-crates-to-steal-developers-credentials-2397935",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-21T14:57:00.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/08/21/hackers-poison-popular-rust-crates-to-steal-developers-credentials/5291075"
  },
  "original_language": "en",
  "account": "Hackers compromised popular Rust packages, embedding malware into the build scripts of crates proc-macro1, arrayref, internment, and append-only-vec. This malicious supply chain attack, disclosed by the Rust Security Response Team, aimed to infiltrate developers' machines. The attack, triggered by a build script fetching malware from a remote server, was limited in its duration but impacted widely used crates. The malicious versions were quickly removed from the registry, yet the damage was potentially extensive. Security firm Aikido analyzed the attack, revealing the malware aimed at various operating systems and browser data, including cryptocurrency wallets. The Rust team removed multiple affected crates, urging developers to review their lockfiles and local caches. The true extent of the attack remains unclear, with details about the compromised maintainer, number of downloads, and systems impacted not disclosed.",
  "summary": "Malicious updates turned routine builds into a delivery system for infostealer malware",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register",
        "title": "Hackers poison popular Rust crates to steal developers' credentials",
        "url": "https://urgent.news/2026/08/21/hackers-poison-popular-rust-crates-to-steal-developers-credentials",
        "published": "2026-08-21T14:57:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}