Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
- ID
- 16259
- Status
- summarized
- Published
- 21 Aug 2026, 4:22 AM
- Fetched
- 21 Aug 2026, 6:04 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/rust-supply-chain-attack-puts-build.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 6.5
- Created
- 21 Aug 2026, 6:07 AM
- Tags
- Audience
- developersai-ml-learners
What happened
A compromised maintainer account published malicious versions of three widely used Rust crates (arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9) on crates.io on August 20, 2026, injecting a typosquatted dependency (proc-macro1) whose build script downloaded and executed a remote payload during compilation. The malicious versions were live for 86-107 minutes before removal; the Rust Security Response Team unyanked earlier safe versions and advises pinning arrayref at 0.3.9 or earlier, with no patched version or CVE assigned yet. RustSec advisories state no evidence of actual usage of the malicious versions.
Why it matters
If you build Rust projects, check ~/.cargo/registry/cache for the deleted crate files and pin arrayref to 0.3.9 or earlier immediately—the attack executed at build time, meaning merely compiling an affected project was enough to run the payload without calling any crate function. This also highlights that maintainer account compromise remains a weak link in supply chain security regardless of language ecosystem.
Discussion angle
Build scripts that execute arbitrary code at compile time are a systemic risk across package managers—what tooling or policies could catch a typosquatted dependency injecting a build-time payload before it runs locally?