Malicious Code Hit Rust Crates With 245 Million Downloads — and It Ran at Compile Time, Not Runtime

Three widely used Rust crates shipped malware to crates.io on August 20: arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9. All three came from the compromised account of maintainer David Roundy — a crates.io user since October 2009 — and arrayref alone carries roughly 245 million all-time downloads. The Rust Security Response Team received a report at 07:15 UTC and yanked the packages fast: the malicious versions were live for between 86 and 107 minutes.

The delivery mechanism is what makes this attack notable. The poisoned releases added a dependency called proc-macro1, a typosquat of the ubiquitous proc-macro2. Its build script reassembled a command-and-control address from base64 fragments, disabled TLS certificate validation, picked a payload matching your OS and CPU architecture, and executed it during cargo build, cargo check, or cargo test. You never had to call a single function from the infected crate. Compiling it was enough — which means CI runners, dev laptops, and cargo install users were all in scope.

The stage-2 implant persisted via Registry Run keys on Windows, LaunchAgents on macOS, and systemd user services on Linux. According to researchers at Wiz, it steals browser credentials from Chrome, Brave, and Edge by querying their SQLite login databases. Wiz also found “substantial overlap” with previous North Korean supply-chain operations, including the Mastra npm compromise and the axios attack — though no vendor has formally attributed this incident to a named actor.

The Rust Security Response Team was explicit that Roundy is a victim, not a perpetrator: “We do not believe the author of arrayref to be acting maliciously, but their computer or credentials are likely compromised.”

What to do, concretely:

Check your local cache. Search ~/.cargo/registry/cache for arrayref 0.3.10, internment 0.8.7, or append-only-vec 0.1.9. If any are present, treat the machine as compromised: rotate credentials, check for the persistence mechanisms above.
Audit CI logs for builds between roughly 05:30 and 09:00 UTC on August 20 that resolved fresh versions of these crates.
Pin arrayref at 0.3.9 or earlier until a clean release lands.

The uncomfortable structural point: Cargo has no equivalent of npm’s publish-age cooldown, which delays newly published versions from being auto-resolved. A 90-minute response time is genuinely good — and it still wasn’t fast enough to stop fresh builds from pulling the poison. Until the ecosystem gets a delay window or mandatory publish attestation, “compromise one maintainer’s laptop” remains a viable attack on a quarter-billion-download dependency chain.

Sources

Related reading