--- title: Hackers Target Popular arrayref Rust Crate in... description: Attackers compromised the maintainer account of the widely used arrayref Rust crate (245M+ downloads), along with append-only-vec and internment, publishing... canonical: https://daily.dev/posts/hackers-target-popular-arrayref-rust-crate-in-supply-chain-attack-qdmz9uxnu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hackers Target Popular arrayref Rust Crate in Supply-Chain Attack | daily.dev og:description: Attackers compromised the maintainer account of the widely used arrayref Rust crate (245M+ downloads), along with append-only-vec and internment, publishing... og:url: https://daily.dev/posts/hackers-target-popular-arrayref-rust-crate-in-supply-chain-attack-qdmz9uxnu og:image: https://api.daily.dev/og/posts/QDmZ9Uxnu.png og:image:alt: Hackers Target Popular arrayref Rust Crate in Supply-Chain Attack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hackers Target Popular arrayref Rust Crate in Supply-Chain Attack **[DevOps.com](https://daily.dev/sources/devops)** · 5 min read · 0 upvotes · 0 comments ## Summary Attackers compromised the maintainer account of the widely used arrayref Rust crate (245M+ downloads), along with append-only-vec and internment, publishing poisoned versions with a typosquatted dependency (proc-macro1) that ran an info-stealing payload during compile-time build scripts. The attackers staged a fake GitHub account impersonating maintainer David Tolnay, published a clean decoy package to build publishing history, then yanked all legitimate 0.3.x versions of arrayref to force developers and CI systems onto the malicious 0.3.10 release. The payload exfiltrates credentials from Chrome, Brave, and Edge, establishes cross-platform persistence, and uses a domain generation algorithm as C2 fallback. Researchers at Wiz found infrastructure overlap with prior North Korean-linked npm supply-chain attacks (Mastra, Axios), suggesting a possible connection to nation-state actors. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happened with the arrayref Rust crate supply chain attack? Hackers compromised the maintainer account behind the arrayref crate (245M+ downloads) and published version 0.3.10 with a typosquatted dependency called proc-macro1 containing a malicious build script. The script executed at compile time, downloading an information-stealing payload that harvested browser credentials and established persistence. The attackers also yanked all legitimate 0.3.x versions to force developers onto the poisoned release. _Rust developers auditing dependency risk can track supply-chain incidents like this on daily.dev._ ### How did the arrayref crate attackers trick developers into installing the malicious version? The attackers yanked every legitimate arrayref 0.3.x version (0.3.5 through 0.3.9) seconds after publishing the poisoned 0.3.10, so running cargo update -p arrayref resolved only to the malicious release. Developers and CI systems saw yank warnings on a trusted, heavily downloaded dependency and applied the 'safe' update, which was actually the attack's delivery mechanism. _Teams hardening CI pipelines against poisoned dependency updates follow incidents like this on daily.dev._ ### What malware capabilities did the arrayref supply chain attack payload have? The build script reconstructed a C2 URL from Base64 fragments, disabled TLS certificate validation, and downloaded an OS-specific backdoor that exfiltrated hostnames, usernames, installed applications, and saved credentials from Chrome, Brave, and Edge browser SQLite stores. It established persistence on Windows, macOS, and Linux, and fell back to a domain generation algorithm producing 10 new .com domains every 5 days if the primary C2 was unreachable. _Security teams investigating credential-stealing malware chains stay current on cases like this via daily.dev._ ## Similar posts on daily.dev - [Be alert: targeted attacks on prominent Rustaceans](https://daily.dev/posts/be-alert-targeted-attacks-on-prominent-rustaceans-ug8iw73la) · Tech Lead Digest · 0 upvotes · 0 comments - [Supply chain nightmare: How Rust will be attacked and what we can do to mitigate the inevitable](https://daily.dev/posts/supply-chain-nightmare-how-rust-will-be-attacked-and-what-we-can-do-to-mitigate-the-inevitable-xdchrtlnw) · Hacker News · 0 upvotes · 1 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#rust](https://daily.dev/tags/rust), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/hackers-target-popular-arrayref-rust-crate-in-supply-chain-attack-qdmz9uxnu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hackers Target Popular arrayref Rust Crate in Supply-Chain Attack","url":"https://daily.dev/posts/hackers-target-popular-arrayref-rust-crate-in-supply-chain-attack-qdmz9uxnu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hackers-target-popular-arrayref-rust-crate-in-supply-chain-attack-qdmz9uxnu"},"datePublished":"2026-08-21T18:33:13.042Z","dateModified":"2026-08-21T18:34:26.682Z","description":"Attackers compromised the maintainer account of the widely used arrayref Rust crate (245M+ downloads), along with append-only-vec and internment, publishing...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0c83529c95d95ec75935936b6c3e5314?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0c83529c95d95ec75935936b6c3e5314?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"DevOps.com","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"DevOps.com","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/db8f2265cff0416c878c6e7e92bb8715","url":"https://daily.dev/sources/devops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hackers-target-popular-arrayref-rust-crate-in-supply-chain-attack-qdmz9uxnu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,rust,malware","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DevOps.com","item":"https://daily.dev/sources/devops"},{"@type":"ListItem","position":3,"name":"Hackers Target Popular arrayref Rust Crate in Supply-Chain Attack"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hackers-target-popular-arrayref-rust-crate-in-supply-chain-attack-qdmz9uxnu#faq","mainEntity":[{"@type":"Question","name":"What happened with the arrayref Rust crate supply chain attack?","acceptedAnswer":{"@type":"Answer","text":"Hackers compromised the maintainer account behind the arrayref crate (245M+ downloads) and published version 0.3.10 with a typosquatted dependency called proc-macro1 containing a malicious build script. The script executed at compile time, downloading an information-stealing payload that harvested browser credentials and established persistence. The attackers also yanked all legitimate 0.3.x versions to force developers onto the poisoned release. Rust developers auditing dependency risk can track supply-chain incidents like this on daily.dev."}},{"@type":"Question","name":"How did the arrayref crate attackers trick developers into installing the malicious version?","acceptedAnswer":{"@type":"Answer","text":"The attackers yanked every legitimate arrayref 0.3.x version (0.3.5 through 0.3.9) seconds after publishing the poisoned 0.3.10, so running cargo update -p arrayref resolved only to the malicious release. Developers and CI systems saw yank warnings on a trusted, heavily downloaded dependency and applied the 'safe' update, which was actually the attack's delivery mechanism. Teams hardening CI pipelines against poisoned dependency updates follow incidents like this on daily.dev."}},{"@type":"Question","name":"What malware capabilities did the arrayref supply chain attack payload have?","acceptedAnswer":{"@type":"Answer","text":"The build script reconstructed a C2 URL from Base64 fragments, disabled TLS certificate validation, and downloaded an OS-specific backdoor that exfiltrated hostnames, usernames, installed applications, and saved credentials from Chrome, Brave, and Edge browser SQLite stores. It established persistence on Windows, macOS, and Linux, and fell back to a domain generation algorithm producing 10 new .com domains every 5 days if the primary C2 was unreachable. Security teams investigating credential-stealing malware chains stay current on cases like this via daily.dev."}}]} ```