# Critical: Rust `arrayref` Crate Poisoned with Infostealer Malware

> Hackers compromised `arrayref`, `append-only-vec`, and `internment` Rust crates to inject infostealer malware, impacting developers and downstream projects.

- Published: 2026-08-21T00:43:46.000Z
- Severity: high
- Category: Supply Chain
- Tags: Rust, Supply Chain Attack, Infostealer, DPRK, Crates Io
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/hackers-poison-arrayref-rust-crate-to-push-infostealer-malware/
- Canonical: https://runtimerebel.com/blog/critical-rust-arrayref-crate-poisoned-with-infostealer-malware

## Key points

- Immediate impact: Developers using affected Rust crates downloaded during the exposure window are at risk of infostealer malware infection.
- Affected systems: Rust projects dependent on `arrayref` 0.3.10, `append-only-vec` 0.1.9, or `internment` 0.8.7.
- Remediation: Assume compromise if affected; rotate all credentials, tokens, keys; rebuild from safe backups.

## Critical [Supply Chain Attack](/glossary#supply-chain-attack) Poisons Widely Used Rust Crates

Threat actors have executed a sophisticated supply chain attack, compromising maintainer accounts for several popular Rust crates—`arrayref`, `append-only-vec`, and `internment`—to distribute [infostealer](/glossary#infostealer) [malware](/glossary#malware). The incident, which had a narrow exposure window of approximately 1.5 hours, allowed malicious code to execute on developers' systems during compilation, posing a significant risk to development environments and downstream projects. The `arrayref` crate alone boasts over 53 million downloads in the past 90 days and a lifetime count exceeding 245 million, indicating the widespread potential impact of this compromise, according to [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-poison-arrayref-rust-crate-to-push-infostealer-malware/).

### Technical Analysis of the Infostealer Campaign

Beginning at 01:17 UTC on August 20, the attackers created GitHub and `crates.io` accounts impersonating prominent Rust developers. The attack leveraged a [typosquatting](/glossary#typosquatting) technique, introducing a dependency on a malicious package named `proc-macro1`, which mimicked the legitimate `proc-macro2` crate. While the initial `proc-macro1@1.0.106` release was benign, a subsequent update to version `1.0.107` at 07:11 UTC introduced the malicious [payload](/glossary#payload).

At 07:15 UTC, `arrayref` version 0.3.10 was published via a legitimate maintainer account, alongside the removal of versions 0.3.5 through 0.3.9, likely to force installations of the compromised release. The `proc-macro1` package included a `build.rs` script that automatically executes during compilation. This script was engineered to reconstruct its infrastructure from base64-encoded fragments and deliver a tailored infostealer payload matching the host operating system (Linux x86-64, Windows x86-64, macOS x86-64, and macOS ARM64).

Analysis by [cloud security](/glossary#cloud-security) company Wiz indicates that the second-stage capabilities of this malware include exfiltrating host information and credentials. Specifically, the infostealer targeted credentials stored in SQLite login databases for popular browsers such as Google Chrome, Brave, and Edge. To ensure [persistence](/glossary#persistence) across various operating systems, the malware establishes footholds via the Registry Run key on Windows, LaunchAgent on macOS, and systemd on Linux. The campaign's infrastructure also shows overlaps with recent supply chain attacks attributed to [DPRK](https://en.wikipedia.org/wiki/APT28) (North Korean) threat groups, including the Mastra and axios campaigns.

### Affected Components and Attack Timeline

The malicious Rust crate releases identified by StepSecurity were `arrayref 0.3.10`, `append-only-vec 0.1.9`, and `internment 0.8.7`. These crates are widely used in critical projects, including [cryptography](/glossary#cryptography) tools like `blake3`, Rust GUI frameworks (`egui`, `eframe`, `iced`), and components within the Ethereum and Solana blockchain ecosystems. The collective download count for `append-only-vec` and `internment` alone nears 19 million installs.

The swift response from `crates.io` led to the deletion of `proc-macro1` at 08:03 UTC and the removal of `arrayref 0.3.10` from the index at 08:41 UTC, limiting the overall exposure duration. However, any development environment that installed these specific malicious versions during the roughly 1.5-hour window, between 07:15 UTC and 08:41 UTC on August 20, 2024, should be considered compromised.

### Actionable Recommendations: Mitigate Rust Crate Infostealer Risks

Organizations and developers must prioritize immediate actions to address potential exposure and secure their development pipelines. The following steps are crucial for effective remediation and preventing future incidents:

*   **Assume Compromise**: If your projects installed `arrayref 0.3.10`, `append-only-vec 0.1.9`, or `internment 0.8.7` during the exposure window, assume your development environment is compromised.
*   **Identify Affected Systems**: Review `Cargo.lock` files within your projects to identify any dependencies on the malicious crate versions.
*   **Detect Arrayref Supply Chain Attack Artifacts**: Look for dropped files such as `/tmp/rust-setup` on Unix-like systems and `%TEMP%\rust-setup.ps1` on Windows. Review network traffic for connections to `23.254.165[.]112` on ports 9089 and 443, which are believed to be command-and-control addresses.
*   **Credential Rotation**: Immediately rotate all accessible credentials, CI tokens, signing keys, and any other secrets that may have been present on a compromised machine.
*   **Environment Rebuild**: Rebuild development and build environments from known-safe backups or clean images to ensure no lingering malware or persistence mechanisms remain.
*   **Pin Safe Versions**: For projects not yet compromised, pin dependencies to known-safe versions of the affected crates. This helps prevent accidental installation of a potentially reintroduced malicious version until the maintainer situation is fully clarified and resolved.

These measures are essential to addressing a compromised Rust development environment remediation strategy and bolstering the security posture against similar supply chain threats.

**Related:** [Rust Supply Chain Attack Puts Build-Time Malware in Crates](/blog/rust-supply-chain-attack-puts-build-time-malware-in-crates), [AUR Compromise: 400+ Packages Distributing Rootkits and Infostealers](/blog/aur-compromise-400-packages-distributing-rootkits-and-infostealers)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/critical-rust-arrayref-crate-poisoned-with-infostealer-malware