Cybersecurity experts have uncovered a sophisticated supply-chain attack that has compromised several popular Rust crates, including arrayref, append-only-vec, and internment. The attackers injected malicious code into these libraries, which are used by thousands of developers worldwide to build software applications.
The hackers took advantage of the maintainer account behind arrayref, one of the most widely used Rust crates with over 53 million downloads in the past 90 days. Within a 23-minute window, they also poisoned two other crates, append-only-vec and internment, which are used by cryptography, graphics, and blockchain tools.
The malicious code injected into these libraries created a dependency on a package called proc-macro1, which is a typosquat impersonating the popular proc-macro2 crate. This allowed the attackers to execute their malware during compilation, reconstructing its infrastructure from base64-encoded fragments and selecting a payload that matches the host operating system.
The researchers at StepSecurity have analyzed the malware and found that it collects credentials from Google Chrome, Brave, and Edge browsers by querying SQLite login databases. The payload also receives an address as an argument, believed to be a command-and-control address, which suggests that the attackers may be using this information for further malicious activities.
The potential impact of this supply-chain attack is significant, with arrayref alone having over 245 million lifetime downloads. Projects using arrayref include blake3, Rust GUI frameworks such as egui, eframe, and iced, and components used in Ethereum and Solana.
Developers who installed the affected crates during the exposure window of nearly 1.5 hours should assume compromise and take immediate action to secure their systems. Recommended checks include searching Cargo.lock files for the dropped files and reviewing traffic to a specific IP address on certain ports.
To prevent similar attacks in the future, developers should ensure that they are using secure dependencies and regularly review their supply chain. By being vigilant and proactive, we can reduce the risk of these types of attacks and protect our software applications from compromise.
In this incident, it is clear that once attackers have valid credentials, prevention scores drop sharply. This highlights the importance of robust security measures and regular vulnerability scanning to detect potential threats before they become major incidents. By staying informed and taking proactive steps to secure our systems, we can minimize the risk of supply-chain attacks and protect our software applications from compromise.
Source: Bleeping Computer — 2026-08-20