--- title: Backdoored Rust packages hit crates.io, exposing... description: Malicious versions of three Rust crates on crates.io, including the widely used arrayref (245 million all-time downloads), were published on August 20 carrying... canonical: https://daily.dev/posts/backdoored-rust-packages-hit-crates-io-exposing-developers-to-malware-at-build-time-ifubmt5lj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Backdoored Rust packages hit crates.io, exposing developers to malware at build time | daily.dev og:description: Malicious versions of three Rust crates on crates.io, including the widely used arrayref (245 million all-time downloads), were published on August 20 carrying... og:url: https://daily.dev/posts/backdoored-rust-packages-hit-crates-io-exposing-developers-to-malware-at-build-time-ifubmt5lj og:image: https://api.daily.dev/og/posts/IfuBmt5lJ.png og:image:alt: Backdoored Rust packages hit crates.io, exposing developers to malware at build time og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Backdoored Rust packages hit crates.io, exposing developers to malware at build time **[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 0 upvotes · 0 comments ## Summary Malicious versions of three Rust crates on crates.io, including the widely used arrayref (245 million all-time downloads), were published on August 20 carrying a backdoor that executed automatically at build time via a build script. The malicious dependency, proc-macro1, was a typosquat of proc-macro2 and reconstructed a C2 URL, disabled TLS validation, and downloaded a platform-specific payload that stole browser credential data and could establish persistence on Linux, Windows, and macOS. Security researchers at Wiz found significant infrastructure overlap with North Korea-linked campaigns including Mastra and Axios npm supply-chain attacks. The compromised packages were live for 86-107 minutes before removal; affected orgs are advised to check Cargo.lock files, rotate credentials, and rebuild from clean sources. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happened with the arrayref Rust crate supply chain attack? Malicious versions of arrayref (0.3.10), internment (0.8.7), and append-only-vec (0.1.9) were published to crates.io on August 20 with a backdoor that ran automatically during compilation via a Rust build script. All three added a dependency on proc-macro1, a typosquat of the legitimate proc-macro2 crate, which reconstructed a C2 URL, disabled TLS validation, and downloaded a platform-specific payload for Linux, Windows, and macOS. _Track supply chain incidents like this arrayref compromise as they surface on daily.dev._ ### How long were the malicious arrayref and internment crates available on crates.io before removal? StepSecurity estimated exposure windows of roughly 86, 90, and 107 minutes for the three compromised crates (arrayref, internment, and append-only-vec) before they and associated packages were deleted from crates.io. Despite the short window, arrayref alone had 245 million all-time downloads and 53.7 million in the prior 90 days, meaning many builds could have resolved the malicious version. _Rust teams weighing lockfile audits after incidents like this can follow the coverage on daily.dev._ ### Why can a malicious Rust crate infect a build without calling any of its functions? Rust build scripts run automatically at compile time, so simply building a project whose lockfile resolved the compromised arrayref 0.3.10 version was enough to trigger the payload, without the code ever being called or executed by the developer. The build script downloaded and ran a second-stage payload as part of the normal compilation process. _Developers hardening CI pipelines against build-time attacks can find related reporting on daily.dev._ ## Similar posts on daily.dev - [Be alert: targeted attacks on prominent Rustaceans](https://daily.dev/posts/be-alert-targeted-attacks-on-prominent-rustaceans-ug8iw73la) · Tech Lead Digest · 0 upvotes · 0 comments - [Supply chain nightmare: How Rust will be attacked and what we can do to mitigate the inevitable](https://daily.dev/posts/supply-chain-nightmare-how-rust-will-be-attacked-and-what-we-can-do-to-mitigate-the-inevitable-xdchrtlnw) · Hacker News · 0 upvotes · 1 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#rust](https://daily.dev/tags/rust), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/backdoored-rust-packages-hit-crates-io-exposing-developers-to-malware-at-build-time-ifubmt5lj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Backdoored Rust packages hit crates.io, exposing developers to malware at build time","url":"https://daily.dev/posts/backdoored-rust-packages-hit-crates-io-exposing-developers-to-malware-at-build-time-ifubmt5lj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/backdoored-rust-packages-hit-crates-io-exposing-developers-to-malware-at-build-time-ifubmt5lj"},"datePublished":"2026-08-21T09:33:36.983Z","dateModified":"2026-08-21T09:34:47.772Z","description":"Malicious versions of three Rust crates on crates.io, including the widely used arrayref (245 million all-time downloads), were published on August 20 carrying...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d62e75e6c6d4579d9baf732b798c846a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d62e75e6c6d4579d9baf732b798c846a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/backdoored-rust-packages-hit-crates-io-exposing-developers-to-malware-at-build-time-ifubmt5lj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,rust,malware","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Backdoored Rust packages hit crates.io, exposing developers to malware at build time"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/backdoored-rust-packages-hit-crates-io-exposing-developers-to-malware-at-build-time-ifubmt5lj#faq","mainEntity":[{"@type":"Question","name":"What happened with the arrayref Rust crate supply chain attack?","acceptedAnswer":{"@type":"Answer","text":"Malicious versions of arrayref (0.3.10), internment (0.8.7), and append-only-vec (0.1.9) were published to crates.io on August 20 with a backdoor that ran automatically during compilation via a Rust build script. All three added a dependency on proc-macro1, a typosquat of the legitimate proc-macro2 crate, which reconstructed a C2 URL, disabled TLS validation, and downloaded a platform-specific payload for Linux, Windows, and macOS. Track supply chain incidents like this arrayref compromise as they surface on daily.dev."}},{"@type":"Question","name":"How long were the malicious arrayref and internment crates available on crates.io before removal?","acceptedAnswer":{"@type":"Answer","text":"StepSecurity estimated exposure windows of roughly 86, 90, and 107 minutes for the three compromised crates (arrayref, internment, and append-only-vec) before they and associated packages were deleted from crates.io. Despite the short window, arrayref alone had 245 million all-time downloads and 53.7 million in the prior 90 days, meaning many builds could have resolved the malicious version. Rust teams weighing lockfile audits after incidents like this can follow the coverage on daily.dev."}},{"@type":"Question","name":"Why can a malicious Rust crate infect a build without calling any of its functions?","acceptedAnswer":{"@type":"Answer","text":"Rust build scripts run automatically at compile time, so simply building a project whose lockfile resolved the compromised arrayref 0.3.10 version was enough to trigger the payload, without the code ever being called or executed by the developer. The build script downloaded and ran a second-stage payload as part of the normal compilation process. Developers hardening CI pipelines against build-time attacks can find related reporting on daily.dev."}}]} ```