--- title: Rust's supply chain got hit, and the real problem is... description: A malicious version of the array-ref crate hit crates.io on August 20th, injecting a typosquatted proc-macro1 package that ran a backdoor via a build.rs script... canonical: https://daily.dev/posts/rust-s-supply-chain-got-hit-and-the-real-problem-is-crates-io-looks-a-lot-like-npm-5rufmereu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Rust's supply chain got hit, and the real problem is crates.io looks a lot like npm | daily.dev og:description: A malicious version of the array-ref crate hit crates.io on August 20th, injecting a typosquatted proc-macro1 package that ran a backdoor via a build.rs script... og:url: https://daily.dev/posts/rust-s-supply-chain-got-hit-and-the-real-problem-is-crates-io-looks-a-lot-like-npm-5rufmereu og:image: https://api.daily.dev/og/posts/5rufmEReu.png og:image:alt: Rust's supply chain got hit, and the real problem is crates.io looks a lot like npm og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Rust's supply chain got hit, and the real problem is crates.io looks a lot like npm **[Trends](https://daily.dev/sources/trends)** · 2 min read · 18 upvotes · 3 comments ## Summary A malicious version of the array-ref crate hit crates.io on August 20th, injecting a typosquatted proc-macro1 package that ran a backdoor via a build.rs script at compile time, stealing host info and browser credentials from Chrome, Brave, and Edge. Nine crates downloaded over a million times daily were affected before the Rust Security Response Team pulled them in about 110 minutes. Infrastructure overlaps with prior DPRK-linked npm attacks on Axios and Nx. The incident reignites debate over whether crates.io's centralized, credential-based publishing model shares npm's structural weaknesses, compounded by findings that 17% of top crates' published code doesn't match their source repos. Suggested fixes include adopting Go-style decentralized imports and checksum databases, plus interim mitigations like pinning dependencies via [patch.crates-io], CI-only publishing, cargo-audit, cargo-vet, and treating build.rs scripts with the same suspicion as npm postinstall hooks. ## Content A malicious version of `array-ref` went live on crates.io on August 20th. It injected a typosquatted dependency called `proc-macro1` (mimicking the legitimate `proc-macro2`) that ran a backdoor through a `build.rs` script at compile time. The payload collected host info, enumerated browser profiles, and queried saved login data from Chrome, Brave, and Edge via SQLite. Infrastructure overlaps with prior DPRK-linked npm campaigns targeting packages like Axios and Nx. The Rust Security Response Team pulled the packages in roughly 110 minutes. Nine crates, downloaded over a million times a day. Two hours of exposure. The community response is split between "Rust handled this well" and "Rust shouldn't be in this position at all." The second camp has a point. The attack worked because compromised maintainer GitHub accounts were enough to push malicious versions to a centralized registry. Sound familiar? It should. This is the npm threat model, just with a smaller developer population and `credentials.toml` instead of `.npmrc`. The reason cargo worm attacks are rarer than npm's isn't architectural — it's that the Rust ecosystem is smaller. That gap is closing. One analysis puts the structural problem bluntly: 17% of top crates' published code doesn't match their source repos. You're not always getting what you think you're getting. The proposed fix that keeps coming up is Go's model: a comprehensive standard library that reduces dependency sprawl, decentralized source-based imports, and a checksum database. Rust's small stdlib is a deliberate design choice, but it pushes developers toward crates.io for things Go ships out of the box — and every dependency is an attack surface. For teams that can't wait for ecosystem-level changes, the interim mitigations are: pin dependencies to git sources via `[patch.crates-io]`, use CI-only publishing (no tokens on developer machines), run `cargo-audit` and `cargo-vet`, and treat `build.rs` scripts with the same suspicion you'd give a postinstall hook in npm. That last one is the uncomfortable truth here. `build.rs` runs arbitrary code at compile time. It's powerful and it's a liability. The Rust community has mostly treated it as a solved problem because the ecosystem was small enough that trust was implicit. It isn't that small anymore. ## Questions this post answers ### What happened in the crates.io array-ref supply chain attack? A malicious version of the array-ref crate was published on crates.io on August 20th, injecting a typosquatted dependency called proc-macro1 that mimicked the legitimate proc-macro2 package. It ran a backdoor through a build.rs script at compile time, collecting host info and querying saved browser login data from Chrome, Brave, and Edge via SQLite. Nine crates downloaded over a million times daily were affected before being pulled in roughly 110 minutes. _Track fast-moving supply chain incidents like this crates.io attack as they unfold on daily.dev._ ### How can I protect my Rust project from malicious build.rs scripts in dependencies? Pin dependencies to git sources using [patch.crates-io] instead of trusting the registry directly, use CI-only publishing so tokens never live on developer machines, and run cargo-audit and cargo-vet regularly. Treat build.rs scripts with the same suspicion given to npm postinstall hooks, since they run arbitrary code at compile time and represent a real attack surface. _Developers hardening Rust build pipelines against supply chain risks follow ongoing coverage on daily.dev._ ### Is crates.io as vulnerable to supply chain attacks as npm? Yes, structurally they share the same threat model: compromised maintainer credentials are enough to push malicious versions to a centralized registry. Rust's smaller ecosystem has made worm-style attacks rarer, not any architectural safeguard, and that gap is closing. One analysis found 17% of top crates' published code doesn't match their source repositories, meaning published code can diverge from what's publicly reviewable. _Weighing registry trust models is easier when tracking npm and crates.io security incidents together on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@coderkini** · 1 upvotes > Seems like the fate of every centralized package manager and it's repositories...is it better to vendor dependencies now? **@akkitto** · 0 upvotes > What about signing packages? **@petermrozek** · 0 upvotes > > ...decentralized source-based imports... > > That's the way to go. Since Rust is compiling every create on build, why the need for a centralised repo in the first place? Just shove in the Git link with a branch and tag/commit id combo in your dependencies and you're done - dependencies locked in place. If everyone does this, the attack surface disappears entirely. And any ecosystem, not only Rust, can benefit from this approach. ## Similar posts on daily.dev - [Supply chain nightmare: How Rust will be attacked and what we can do to mitigate the inevitable](https://daily.dev/posts/supply-chain-nightmare-how-rust-will-be-attacked-and-what-we-can-do-to-mitigate-the-inevitable-xdchrtlnw) · Hacker News · 0 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#rust](https://daily.dev/tags/rust), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/rust-s-supply-chain-got-hit-and-the-real-problem-is-crates-io-looks-a-lot-like-npm-5rufmereu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Rust's supply chain got hit, and the real problem is crates.io looks a lot like npm","url":"https://daily.dev/posts/rust-s-supply-chain-got-hit-and-the-real-problem-is-crates-io-looks-a-lot-like-npm-5rufmereu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/rust-s-supply-chain-got-hit-and-the-real-problem-is-crates-io-looks-a-lot-like-npm-5rufmereu"},"datePublished":"2026-09-01T12:27:28.709Z","dateModified":"2026-09-01T12:28:15.564Z","description":"A malicious version of the array-ref crate hit crates.io on August 20th, injecting a typosquatted proc-macro1 package that ran a backdoor via a build.rs script...","image":"https://i.ytimg.com/vi/A4DxpRTpkFk/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/A4DxpRTpkFk/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Trends","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trends","logo":"https://media.daily.dev/image/upload/s--ZfSp3asX--/f_auto,q_auto/v1780996004/logos/trends?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trends"},"commentCount":3,"discussionUrl":"https://daily.dev/posts/rust-s-supply-chain-got-hit-and-the-real-problem-is-crates-io-looks-a-lot-like-npm-5rufmereu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":18},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":3}],"keywords":"security,rust,malware,npm","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trends","item":"https://daily.dev/sources/trends"},{"@type":"ListItem","position":3,"name":"Rust's supply chain got hit, and the real problem is crates.io looks a lot like npm"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/rust-s-supply-chain-got-hit-and-the-real-problem-is-crates-io-looks-a-lot-like-npm-5rufmereu","comment":[{"@type":"Comment","text":"Seems like the fate of every centralized package manager and it’s repositories…is it better to vendor dependencies now?","datePublished":"2026-09-02T16:21:09.477Z","url":"https://daily.dev/posts/5rufmEReu#c-uZaUZGOzr","author":{"@type":"Person","name":"Ranganath Kini","url":"https://daily.dev/coderkini","image":"https://avatars.githubusercontent.com/u/117920663?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"What about signing packages?","datePublished":"2026-09-02T20:06:53.260Z","url":"https://daily.dev/posts/5rufmEReu#c-yXbzKll80","author":{"@type":"Person","name":"Daniel","url":"https://daily.dev/akkitto","image":"https://media.daily.dev/image/upload/s--FtwJqX4c--/f_auto/v1754900041/avatars/avatar_29TCpY2hJR72V3BlxPXzX?_a=BAMClqZW0"}},{"@type":"Comment","text":"…decentralized source-based imports…\n\nThat’s the way to go. Since Rust is compiling every create on build, why the need for a centralised repo in the first place? Just shove in the Git link with a branch and tag/commit id combo in your dependencies and you’re done - dependencies locked in place. If everyone does this, the attack surface disappears entirely. And any ecosystem, not only Rust, can benefit from this approach.","datePublished":"2026-09-03T06:59:07.375Z","dateModified":"2026-09-03T06:59:44.804Z","url":"https://daily.dev/posts/5rufmEReu#c-NPGQyoQZQ","author":{"@type":"Person","name":"Peter Mrożek","url":"https://daily.dev/petermrozek","image":"https://media.daily.dev/image/upload/s--pBfYX68K--/f_auto/v1769247960/avatars/avatar_Qz65P1nVw3Bu6C5YwaZgA?_a=BAMAMiiu0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/rust-s-supply-chain-got-hit-and-the-real-problem-is-crates-io-looks-a-lot-like-npm-5rufmereu#faq","mainEntity":[{"@type":"Question","name":"What happened in the crates.io array-ref supply chain attack?","acceptedAnswer":{"@type":"Answer","text":"A malicious version of the array-ref crate was published on crates.io on August 20th, injecting a typosquatted dependency called proc-macro1 that mimicked the legitimate proc-macro2 package. It ran a backdoor through a build.rs script at compile time, collecting host info and querying saved browser login data from Chrome, Brave, and Edge via SQLite. Nine crates downloaded over a million times daily were affected before being pulled in roughly 110 minutes. Track fast-moving supply chain incidents like this crates.io attack as they unfold on daily.dev."}},{"@type":"Question","name":"How can I protect my Rust project from malicious build.rs scripts in dependencies?","acceptedAnswer":{"@type":"Answer","text":"Pin dependencies to git sources using [patch.crates-io] instead of trusting the registry directly, use CI-only publishing so tokens never live on developer machines, and run cargo-audit and cargo-vet regularly. Treat build.rs scripts with the same suspicion given to npm postinstall hooks, since they run arbitrary code at compile time and represent a real attack surface. Developers hardening Rust build pipelines against supply chain risks follow ongoing coverage on daily.dev."}},{"@type":"Question","name":"Is crates.io as vulnerable to supply chain attacks as npm?","acceptedAnswer":{"@type":"Answer","text":"Yes, structurally they share the same threat model: compromised maintainer credentials are enough to push malicious versions to a centralized registry. Rust's smaller ecosystem has made worm-style attacks rarer, not any architectural safeguard, and that gap is closing. One analysis found 17% of top crates' published code doesn't match their source repositories, meaning published code can diverge from what's publicly reviewable. Weighing registry trust models is easier when tracking npm and crates.io security incidents together on daily.dev."}}]} ```