The Rust Security Response Team disclosed a supply chain attack in which the crate proc-macro1 (and related crates proc-macro-en, aovine, arone, aronenao, tinymember) contained a malicious build script downloading a payload. The popular arrayref crate, along with internment and append-only-vec, were republished to depend on proc-macro1 by what is believed to be a compromised account rather than a malicious author. Malicious versions arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9 were deleted from crates.io, legitimate yanked versions were restored, and the account was locked. Developers are advised to check their local cargo registry cache for these specific malicious versions using a provided find command.
Questions this post answers
Which versions of the arrayref, internment, and append-only-vec Rust crates were affected by the crates.io supply chain attack?
The malicious versions are arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9. These were republished to depend on the malicious proc-macro1 crate, which contained a build script downloading a malicious payload. Crates.io deleted these malicious versions, unyanked the legitimate prior versions, and locked the affected author's account as a precaution. daily.dev helps developers track supply chain incidents like this arrayref crate compromise as they unfold.
How do I check if I have the malicious proc-macro1 or arrayref crate versions installed locally in Rust?
Run a find command against ~/.cargo/registry/cache searching for files named append-only-vec-0.1.9.crate, arrayref-0.3.10.crate, internment-0.8.7.crate, and any version of proc-macro1, proc-macro-en, aovine, arone, aronenao, or tinymember. Any matches indicate the compromised versions were pulled into a local dependency tree and should be removed. Rust developers auditing dependencies for compromised crates can follow ongoing security coverage on daily.dev.
What crates were deleted from crates.io due to the proc-macro1 malware incident?
Crates.io deleted proc-macro1, proc-macro-en, aovine, arone, aronenao, and tinymember entirely, since these existed solely to deliver a malicious build script. It also removed the malicious versions of arrayref, internment, and append-only-vec that had been republished to depend on proc-macro1, while restoring the legitimate versions that had been wrongly yanked. Teams vetting Rust dependencies for hidden malware use daily.dev to stay current on crates.io incidents.