Malicious Rust Crate Releases Executed Payloads at Build Time
The Rust Project has deleted malicious releases of three crates from crates.io after a compromised maintainer account added a typosquatted dependency whose build script downloaded and executed a remote payload during compilation. The affected versions were arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9, all published on August 20, 2026.
Arrayref 0.3.10 was available for 86 minutes, internment 0.8.7 for 90 minutes, and append-only-vec 0.1.9 for 107 minutes. The Rust Security Response Team said it had no evidence that the malicious versions were used. No CVE has been assigned and no patched release is available.
A build script turned dependency resolution into execution
Each compromised manifest added one dependency: proc-macro1, a typosquat of the widely used proc-macro2 crate. Its library source was a genuine copy of proc-macro2, enabling normal-looking builds, but its build script reconstructed a payload host and command-and-control address from base64 fragments.
The script installed a custom certificate verifier that accepted all checks, selected a payload for the operating system and CPU architecture, and launched it outside Cargo’s normal process handling. On Unix and macOS, it wrote an executable to /tmp/rust-setup. On Windows, it created a PowerShell script and a VBScript launcher under wscript.exe.
This design meant that simply resolving and building the malicious dependency could run the payload; code from the affected crates did not need to be called. The Nextron Systems GmbH research team first discovered and reported the malicious package, and the response team verified the build script after receiving the report at 07:15 UTC.
Yanked releases created an update lure
The attacker also yanked arrayref versions 0.3.5 through 0.3.9 in the same minute as the malicious publication. The researcher who encountered the incident said this made 0.3.10 appear to be the only version that would avoid Cargo’s warning about updating to a yanked release.
The exposure mattered because arrayref had 245,385,500 all-time downloads and 53,905,601 downloads in the 90 days ending August 20, with 403 crates depending on it. Dependency ranges in a reported chain from winit through sctk-adwaita and tiny-skia accepted the 0.3.10 release.
The incident follows the same trust-abuse pattern seen in package ecosystem trust abuse, where package ecosystems can become a delivery route through transitive dependencies rather than direct software downloads. Wiz reported that the second-stage implant used HTTPS POST for beaconing, established persistence on Windows, macOS and Linux, and supported commands for termination, command-and-control changes, persistence and further script execution.
What development teams should do
Developers should search ~/.cargo/registry/cache for deleted crate files and pin arrayref to 0.3.9 or earlier. The Rust Security Response Team unyanked those previously yanked versions as part of the response.
Cargo has no shipped global minimum publish-age control, although a pull request for such a setting entered final comment period on August 18 and remained unmerged as of August 21. For businesses, the immediate implication is to inspect lockfiles and build caches, constrain dependency updates, and treat every build script in a newly resolved package as executable supply-chain risk.