Malicious Rust crate releases targeted developers with credential-stealing malware

An attacker compromised a Rust package maintainer account and used it to distribute malware through three widely used crates, according to analyses from StepSecurity, Wiz, SafeDep and Aikido. The affected releases were arrayref 0.3.10, append-only-vec 0.1.9 and internment 0.8.7.

The campaign relied on a typosquatted dependency named proc-macro1, designed to resemble the legitimate proc-macro2 package. Although the primary crate source code was largely unchanged, the malicious dependency contained a build.rs script that ran automatically during compilation. The script decoded embedded components and selected an operating-system-specific payload for Linux, Windows or macOS, including Apple Silicon systems.

On Unix-based systems, the malware reportedly drops an executable named /tmp/rust-setup. Windows infections use a PowerShell script in the temporary directory, launched through hidden Windows Script Host components. Researchers said the second stage can gather system information and browser-stored credentials, including login data held in Chrome, Brave and Edge SQLite databases.

The malware also attempts to maintain access through platform-specific mechanisms: Registry Run entries on Windows, LaunchAgents on macOS and systemd configuration on Linux. Investigators identified network activity involving 23.254.165[.]112 over ports 9089 and 443.

Exposure and response

Arrayref has accumulated more than 245 million downloads, with recent usage exceeding 53 million downloads in a 90-day period. It is used by projects involving cryptography, graphics, blockchain software and Rust interface frameworks. The other two affected packages collectively account for millions of additional installations.

The releases appeared on August 20, 2026, and were removed after the incident was reported. The exposure period lasted roughly 90 minutes. Investigators also found several other suspicious crates linked to the same activity, including aovine, arone, aronenao and tinymember; those packages have since been removed from crates.io.

Developers who built software while the affected versions were available should inspect lockfiles and build hosts for dropped files and suspicious connections. Confirmed victims should rotate credentials, CI/CD tokens, signing keys and other secrets, then rebuild from trusted sources. Projects not known to be compromised should pin verified versions until the maintainer accounts and package history are fully reviewed.