Hackers compromised the maintainer account for the widely used Rust crate arrayref and briefly used it to deliver malware to developers who compiled affected code. The malicious releases were arrayref 0.3.10, append-only-vec 0.1.9, and internment 0.8.7, which pulled in a typosquatted dependency, proc-macro1, whose build script ran automatically during compilation and dropped host-specific malware for Windows, Linux, and macOS. Researchers say the second stage stole browser credentials, established persistence, and may overlap with recent North Korea-linked supply-chain activity.
Why it matters: Developers and organizations that built projects with these crates during the exposure window should assume compromise, rotate credentials and signing secrets, and rebuild affected systems from clean backups. Because arrayref is heavily used across cryptography, graphics, and blockchain software, the blast radius could extend far beyond a single package.
2026.08.21
98% relevant
This article is a direct update on the same crates.io supply-chain attack centered on malicious arrayref releases and related crates. It adds timing on how long the poisoned versions were live, names additional malicious crates removed by the Rust team, and describes the build-script payload behavior across Windows, Linux, and macOS, including browser and crypto-wallet credential theft and persistence.
Ionut Arghire
2026.08.21
97% relevant
This article updates the same arrayref crates.io compromise and adds likely attribution to North Korea's Sapphire Sleet, plus infrastructure links to the earlier Axios and Mastra npm supply-chain attacks and more detail on the proc-macro1 dependency and payload delivery.
Bill Toulas
2026.08.20
100% relevant
This article establishes a distinct supply-chain attack centered on the compromise of the arrayref maintainer account and malicious Rust crate releases, not the same underlying event as any tracked story listed.
← Back to all stories