--- title: Hackers poison arrayref Rust crate to push infostealer... description: Attackers compromised the maintainer account of the popular Rust crate arrayref, along with append-only-vec and internment, injecting a dependency on a... canonical: https://daily.dev/posts/hackers-poison-arrayref-rust-crate-to-push-infostealer-malware-zc3viwbyn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hackers poison arrayref Rust crate to push infostealer malware | daily.dev og:description: Attackers compromised the maintainer account of the popular Rust crate arrayref, along with append-only-vec and internment, injecting a dependency on a... og:url: https://daily.dev/posts/hackers-poison-arrayref-rust-crate-to-push-infostealer-malware-zc3viwbyn og:image: https://api.daily.dev/og/posts/ZC3vIWbyN.png og:image:alt: Hackers poison arrayref Rust crate to push infostealer malware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hackers poison arrayref Rust crate to push infostealer malware **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 4 min read · 0 upvotes · 0 comments ## Summary Attackers compromised the maintainer account of the popular Rust crate arrayref, along with append-only-vec and internment, injecting a dependency on a typosquatted package called proc-macro1 that impersonated proc-macro2. During compilation, a build.rs script fetched OS-specific infostealer payloads that stole browser credentials and established persistence on Windows, macOS, and Linux. The attack window lasted about 1.5 hours on August 20, with arrayref alone having over 245 million lifetime downloads and dependents including blake3, egui, and Ethereum/Solana components. Researchers at Wiz found infrastructure overlap with prior DPRK-linked supply chain attacks. Crates.io removed the malicious packages within hours; affected developers are urged to check for compromise, rotate credentials, and pin safe versions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happened with the arrayref Rust crate supply chain attack? Attackers compromised the maintainer account behind arrayref, append-only-vec, and internment, publishing malicious versions (arrayref 0.3.10, append-only-vec 0.1.9, internment 0.8.7) that added a dependency on proc-macro1, a typosquat of proc-macro2. A build.rs script executed during compilation, downloading OS-specific infostealer payloads that stole browser credentials and set up persistence. Crates.io removed the packages within about 1.5 hours, on August 20. _Track fast-moving supply chain incidents like this to decide whether to pin or rotate Rust dependencies, via daily.dev._ ### What should I do if I installed arrayref 0.3.10 or proc-macro1? Assume compromise if either was installed during the roughly 1.5-hour exposure window on August 20, since arrayref versions 0.3.5 through 0.3.9 were removed to force the malicious update. Recommended steps include checking Cargo.lock files for proc-macro1, looking for dropped files like /tmp/rust-setup or %TEMP%\rust-setup.ps1, reviewing traffic to 23.254.165.112 on ports 9089 and 443, and rotating all credentials, CI tokens, and signing keys if compromise is confirmed. _Developers auditing Rust dependencies for compromise can follow incident response threads like this on daily.dev._ ### Which Rust projects were affected by the arrayref malware attack? Projects depending on arrayref, append-only-vec, or internment were exposed, including blake3, Rust GUI frameworks egui, eframe, and iced, and components used in Ethereum and Solana. arrayref has over 245 million lifetime downloads and more than 53 million downloads in the prior 90 days, making the blast radius substantial across cryptography, graphics, and blockchain tooling. _Anyone maintaining a dependency tree touching these crates can monitor fallout and fixes on daily.dev._ ## Similar posts on daily.dev - [Be alert: targeted attacks on prominent Rustaceans](https://daily.dev/posts/be-alert-targeted-attacks-on-prominent-rustaceans-ug8iw73la) · Tech Lead Digest · 0 upvotes · 0 comments - [Supply chain nightmare: How Rust will be attacked and what we can do to mitigate the inevitable](https://daily.dev/posts/supply-chain-nightmare-how-rust-will-be-attacked-and-what-we-can-do-to-mitigate-the-inevitable-xdchrtlnw) · Hacker News · 0 upvotes · 1 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#rust](https://daily.dev/tags/rust), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/hackers-poison-arrayref-rust-crate-to-push-infostealer-malware-zc3viwbyn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hackers poison arrayref Rust crate to push infostealer malware","url":"https://daily.dev/posts/hackers-poison-arrayref-rust-crate-to-push-infostealer-malware-zc3viwbyn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hackers-poison-arrayref-rust-crate-to-push-infostealer-malware-zc3viwbyn"},"datePublished":"2026-08-20T17:55:17.973Z","dateModified":"2026-08-21T09:34:45.297Z","description":"Attackers compromised the maintainer account of the popular Rust crate arrayref, along with append-only-vec and internment, injecting a dependency on a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f9aa8236cc54f04087bdb0972fdd42c9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f9aa8236cc54f04087bdb0972fdd42c9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hackers-poison-arrayref-rust-crate-to-push-infostealer-malware-zc3viwbyn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,rust,malware","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Hackers poison arrayref Rust crate to push infostealer malware"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hackers-poison-arrayref-rust-crate-to-push-infostealer-malware-zc3viwbyn#faq","mainEntity":[{"@type":"Question","name":"What happened with the arrayref Rust crate supply chain attack?","acceptedAnswer":{"@type":"Answer","text":"Attackers compromised the maintainer account behind arrayref, append-only-vec, and internment, publishing malicious versions (arrayref 0.3.10, append-only-vec 0.1.9, internment 0.8.7) that added a dependency on proc-macro1, a typosquat of proc-macro2. A build.rs script executed during compilation, downloading OS-specific infostealer payloads that stole browser credentials and set up persistence. Crates.io removed the packages within about 1.5 hours, on August 20. Track fast-moving supply chain incidents like this to decide whether to pin or rotate Rust dependencies, via daily.dev."}},{"@type":"Question","name":"What should I do if I installed arrayref 0.3.10 or proc-macro1?","acceptedAnswer":{"@type":"Answer","text":"Assume compromise if either was installed during the roughly 1.5-hour exposure window on August 20, since arrayref versions 0.3.5 through 0.3.9 were removed to force the malicious update. Recommended steps include checking Cargo.lock files for proc-macro1, looking for dropped files like /tmp/rust-setup or %TEMP%\\rust-setup.ps1, reviewing traffic to 23.254.165.112 on ports 9089 and 443, and rotating all credentials, CI tokens, and signing keys if compromise is confirmed. Developers auditing Rust dependencies for compromise can follow incident response threads like this on daily.dev."}},{"@type":"Question","name":"Which Rust projects were affected by the arrayref malware attack?","acceptedAnswer":{"@type":"Answer","text":"Projects depending on arrayref, append-only-vec, or internment were exposed, including blake3, Rust GUI frameworks egui, eframe, and iced, and components used in Ethereum and Solana. arrayref has over 245 million lifetime downloads and more than 53 million downloads in the prior 90 days, making the blast radius substantial across cryptography, graphics, and blockchain tooling. Anyone maintaining a dependency tree touching these crates can monitor fallout and fixes on daily.dev."}}]} ```