Malicious Rust Crate Releases Added a Build-Time Payload Through a Typosquatted Dependency
Summary
Three malicious Rust crate releases added a typosquatted dependency whose build script downloaded and ran a payload during compilation. The releases were removed within 86–107 minutes; RustSec reported no evidence they were used.
Key points
- A compromised maintainer account published malicious releases of arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 on August 20, 2026; all were removed within 86–107 minutes.
- The releases added proc-macro1, a typosquat of proc-macro2. Its build script could run during compilation without code from the affected crates being called.
- The script selected a payload for the operating system and CPU architecture, disabled TLS certificate validation, and launched the payload; analysis says builds, checks, and tests could trigger it.
- The implant reportedly supports C2 communication and persistence on Windows, macOS, and Linux. Wiz said it steals browser credentials; Nextron's analyzed Windows payload queried usernames and origins but did not directly extract password values. Linux and macOS payloads were not analyzed.
- The Rust Security Response Team said the maintainer's computer or credentials were likely compromised; how the account was compromised and any responsible actor remain unknown.
- RustSec advisories reported no evidence that the malicious versions were used. No CVE was assigned, and developers were advised to inspect their Cargo cache and pin arrayref to 0.3.9 or earlier.
Article Details
- Attack Vectors
- A compromised maintainer account published affected crate releases with a typosquatted proc-macro1 dependency. Resolving and building the dependency was enough to run its build script; the affected crate's functions did not need to be called.
- The build script assembled the payload host and C2 address from base64 fragments, selected a payload by operating system and CPU architecture, and downloaded and launched it.
- On Windows, the payload was launched through a hidden PowerShell script and VBScript launcher. On Unix and macOS, it was written to /tmp/rust-setup and launched detached.
- According to the article's account of Wiz's findings, the stage-2 implant beaconed over HTTPS POST and supported commands for termination, C2 reconfiguration, persistence installation, and downloading and running further scripts.
- Defensive Notes
- The Rust Security Response Team advised developers to inspect ~/.cargo/registry/cache for the deleted crate files and pin arrayref to 0.3.9 or earlier.
- The Rust Security Response Team unyanked the maliciously yanked versions during its response. The article reports no patched version and no CVE assignment.
- RustSec advisories for the affected crates recorded no evidence that the malicious versions were used; the article does not establish that they were used in builds.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
rchaitm@gmail[.]com | Listed as forged author metadata associated with the malicious crate activity. | |
| HOSTNAME | hwsrv-798836[.]hostwindsdns[.]com | Listed by StepSecurity among indicators for the incident's network infrastructure. |
| IPV4 | 23[.]254[.]165[.]112 | Listed by StepSecurity as the payload host on port 9089 and C2 on port 443. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe build script reassembled the payload host and C2 address from base64 fragments.T1059.001 · PowerShellOn Windows, the malware wrote a PowerShell script to %TEMP% and launched it hidden.T1059.005 · Visual BasicOn Windows, a VBScript launcher under wscript.exe launched the PowerShell script.T1071.001 · Web ProtocolsAccording to the article's account of Wiz's findings, the stage-2 implant beaconed to C2 over HTTPS POST.T1105 · Ingress Tool TransferThe build script downloaded a remote payload; the stage-2 implant also supported downloading and running further scripts.T1195.001 · Compromise Software Dependencies and Development ToolsThe malicious releases added a typosquatted proc-macro1 dependency whose build script ran when projects resolved and built it.T1543.001 · Launch AgentThe stage-2 implant persisted through a LaunchAgent on macOS.T1543.002 · Systemd ServiceThe stage-2 implant persisted through a systemd user service on Linux.T1547.001 · Registry Run Keys / Startup FolderThe stage-2 implant persisted through a Registry Run key on Windows.T1555.003 · Credentials from Web BrowsersWiz said the implant stole browser credentials by querying SQLite login databases; Nextron's analysis of the Windows payload found it queried origin_url and username_value but did not directly extract password_value, and Linux and macOS payloads were not analyzed.
People
Products
append-only-vecThe Rust Project removed malicious releases of arrayref, internment, and append-only-vec after a compromised maintainer account published typosquatted dependencies that executed a remote payload during build time.arrayrefThe Rust Project removed malicious releases of arrayref, internment, and append-only-vec after a compromised maintainer account published typosquatted dependencies that executed a remote payload during build time.internmentThe Rust Project removed malicious releases of arrayref, internment, and append-only-vec after a compromised maintainer account published typosquatted dependencies that executed a remote payload during build time.proc-macro1The incident abused proc-macro1 to bypass normal build expectations, and the Rust Security Response Team advised developers to inspect local cargo caches and pin arrayref to 0.3.9 or earlier.proc-macro2Each compromised release carried a single added line in its manifest, a dependency on proc-macro1, a typosquat of the ubiquitous proc-macro2 crate.