Rust Supply-Chain Attack Poisoned Three Crates With a Build-Time Dropper
Summary
A compromised maintainer account published poisoned arrayref, internment and append-only-vec releases that pulled in typosquatted Rust droppers, enabling code execution during builds. Step Security traced the attack and reproduced its outbound connection; the malicious1
Key points
- On Aug. 20, 2026, arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 were published from a maintainer account assessed as compromised. The releases were removed, and clean versions were restored.
- The poisoned releases added proc-macro1, a typosquat whose version 1.0.107 included a build.rs dropper. It fetched and launched a platform payload during compilation, with TLS certificate validation disabled. proc-macro-en was identified as a second dropper.
- The attacker yanked arrayref’s clean 0.3.x releases shortly after publishing 0.3.10, making the poisoned release the only modern non-yanked option and using Cargo’s warning to prompt upgrades.
- In a workflow reproduction, Step Security observed an outbound connection to 23.254.165.112:9089 during a build. A later run blocked that connection with an egress policy, while the build itself still succeeded.
- The article gives exposure windows of 86 minutes for arrayref, 90 for internment and 107 for append-only-vec, within an overall 07:11–09:25 UTC window on Aug. 20. It recommends checking lockfiles and caches, rebuilding from clean sources, and rotating credentials accessible to affected builds.
- Persistence artifacts and additional command-and-control addresses attributed to infected Linux hosts were reported by third parties and were not independently reproduced by the article’s authors.
Article Details
- Attack Vectors
- A compromised maintainer account published malicious versions of arrayref, internment, and append-only-vec, adding a dependency on the typosquatted proc-macro1 crate.
- The proc-macro1 build.rs ran during Cargo builds, decoded base64 URL fragments, fetched a platform-specific payload over TLS with certificate validation disabled, and launched it detached.
- The attacker yanked clean arrayref releases shortly after publishing the poisoned release, steering developers who ran cargo update toward arrayref 0.3.10.
- The Windows payload launcher used a VBS wrapper under wscript.exe with no console or window. A third-party report described Linux persistence via a systemd service; this behavior was not independently reproduced by the article's authors.
- Defensive Notes
- Treat builds that resolved arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9, or any version of proc-macro1 or proc-macro-en during 07:11–09:25 UTC on 2026-08-20 as potentially compromised.
- Check Cargo.lock files, local and CI Cargo caches, vendored dependencies, and build logs; deleting malicious releases from crates.io does not remove cached artifacts.
- Review egress logs for the listed campaign IPs and inspect Unix and Windows temp directories for the reported dropper artifacts. On Linux, also check the reported persistence directories, executables, and unexpected systemd services.
- Rotate credentials accessible to affected build machines, including SSH keys, cloud tokens, API tokens, signing keys, and CI secrets; rebuild affected artifacts from clean sources on clean infrastructure.
- Use clean versions arrayref 0.3.9, internment 0.8.6, and append-only-vec 0.1.8; verify resolved versions in lockfiles, commit Cargo.lock for applications, and use --locked in CI.
- Block the reported IPs at egress and consider the surrounding Hostwinds ranges. The article notes that cargo audit may not flag deleted malicious versions.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | hwsrv-798836[.]hostwindsdns[.]com | Hostwinds VPS hostname listed in the article's campaign network indicators. |
| IPV4 | 23[.]254[.]165[.]112 | Campaign payload host at port 9089 and C2 address at port 443. |
| IPV4 | 23[.]254[.]167[.]107 | Additional C2 address reported by a third party in the RustSec advisory thread. |
| IPV4 | 23[.]254[.]167[.]216 | Stage-2 C2 address reported by a third party on an infected Linux host. |
| SHA256 | 25ad700976873c76af785cb99b33c48db7df8b81f21d1e9e06b3676b9a9373ae | Registry-verified SHA-256 checksum for the malicious arrayref-0.3.10 crate. |
| SHA256 | 61198155da51b838772eecf5bfaac6cbc4dcc388dccc56658fc28a8e831b34d4 | Registry-verified SHA-256 checksum for the malicious proc-macro1-1.0.107 crate. |
| URL | hxxps[:]//23[.]254[.]165[.]112:9089/ | Payload URL decoded from the dropper's base64 fragments. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe dropper split payload and C2 addresses into base64 fragments to prevent direct URL string matching in the source.T1036.005 · Match Legitimate Resource Name or LocationThe attacker published proc-macro1 as a typosquat of proc-macro2 and used a publisher account impersonating David Tolnay.T1059.005 · Visual BasicOn Windows, the dropped rust-setup-launch.vbs wrapper was launched through wscript.exe.T1078 · Valid AccountsThe Rust Security Response Team assessed the legitimate maintainer's machine or credentials as compromised; the account was used to publish poisoned crate releases.T1105 · Ingress Tool TransferThe build script downloaded a platform-specific stage-2 binary from 23.254.165.112:9089.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious build-time dependencies were introduced through poisoned Rust crate releases distributed via crates.io.T1543.002 · Systemd ServiceA third-party report described a systemd service registered to restart the stage-2 payload on an infected Linux host; the article's authors had not independently reproduced this.T1564.003 · Hidden WindowThe Windows payload launcher was configured to run with no console or visible window.
People
David RoundyLongtime maintainer of arrayref, internment, and append-only-vec. The Rust Security Response Team assessed his machine or credentials as compromised and did not believe he was acting maliciously.David TolnayAuthor of the legitimate proc-macro2 crate whose identity was impersonated by the proc-macro1 publisher.jhobernResearcher who reported the arrayref compromise to RustSec and notified the Rust security team.
Vendors
Tools
cargo auditthe malicious versions were deleted rather than yanked, and the RustSec advisories are still pending, cargo audit reports clean for a project that pinned a poisoned version. Worse, a machine with a warmcargo vetDependency provenance: tools like cargo vet and cargo audit, plus alerting on "yanked" warnings treated as release signals rather than chores, all raise the cost of this attack class. Note the gap this incident exposed:harden-runnerRuntime Analysis with Harden-Runner