Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
Summary: The Rust Project deleted malicious releases of arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 from crates.io after a compromised maintainer account added a typosquatted dependency, proc-macro1, whose build script downloaded and executed a remote payload during compilation. The three releases were published from the same owner account on August 20, 2026 and removed within 86, 90, and 107 minutes respectively, with the arrayref account still locked and no CVE assigned.
Bottom line: arrayref alone has 245,385,500 all-time downloads and 403 dependent crates, and Wiz Research says the impacted packages sit in 35% of cloud and code environments - while Cargo still has no shipped equivalent to the publish-age cooldown that GitHub shipped for Dependabot in July.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026