Hackers poison popular Rust crates to steal developers' credentials
- ID
- 16467
- Status
- summarized
- Published
- 21 Aug 2026, 10:57 PM
- Fetched
- 21 Aug 2026, 11:39 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/21/hackers-poison-popular-rust-crates-to-steal-developers-credentials/5291075
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 7.0
- Created
- 21 Aug 2026, 11:41 PM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
Attackers compromised a legitimate Rust crate maintainer's credentials and published poisoned versions of arrayref (0.3.10), internment (0.8.7), and append-only-vec (0.1.9) on crates.io, each live for 86-107 minutes before removal. The malicious code hid in a typosquat crate called proc-macro1 (mimicking proc-macro2), using its build.rs script to download OS-specific infostealer payloads during compilation that targeted Chromium-based browser data including Chrome, Brave, and Edge profiles.
Why it matters
If you build Rust projects with Cargo, pin your dependencies to specific versions or use a lockfile and a private registry mirror rather than pulling latest from crates.io in CI. The attack exploited Cargo's automatic execution of build.rs scripts during compilation, meaning any crate in your dependency tree can run arbitrary code on your build machine, not just at runtime. Review whether your CI environment isolates build steps from developer credentials and browser sessions.
Discussion angle
Cargo's build.rs execution model means every transitive dependency can run arbitrary code at compile time, unlike ecosystems where install scripts are more visible or restricted. Discuss whether your team audits dependency trees for build scripts and whether lockfiles alone are sufficient given that maintainers can be compromised.