What happened (short and spicy)

In August, someone took a very bad detour into the Rust ecosystem and tainted a widely used library so that developers literally pulled malware in while compiling their code. The popular crate arrayref — used by cryptography, GUI frameworks, and blockchain projects — was modified to depend on a sneaky typo-squat package called proc-macro1. That tiny name difference hid a nasty surprise: build-time code that ran on developers’ machines.

The attacker also touched two sibling crates (append-only-vec and internment) within the same short window. The malicious releases kept the original source code intact but added that one dodgy dependency, so everything looked normal until your compiler executed the build script.

Why this is nasty and what to look for

The injected package included a build script that auto-runs during compilation, reassembled itself from embedded fragments, and picked a payload tailored to the host OS (Linux, Windows, macOS, and macOS on ARM). On Unix-y systems it dropped and launched a /tmp/rust-setup binary; on Windows it created a PowerShell stub in the temp folder and used hidden script hosts to keep things alive. The payload connects back to a command-and-control address, harvests host details and credentials, and tries to persist via system startup mechanisms (Registry Run keys on Windows, LaunchAgent on macOS, and systemd on Linux).

Security teams observed the malware grabbing browser logins from SQLite databases (Chrome, Brave, Edge) and sending data back to an external server. The campaign also reused infrastructure seen in other recent supply intrusions, raising suspicions about an organized actor behind it.

  • Crates affected: arrayref (malicious release), append-only-vec, internment.
  • Typosquat used: proc-macro1 (impersonating proc-macro2).
  • Persistence points: Registry Run, LaunchAgent, systemd.
  • Files to spot: /tmp/rust-setup, %TEMP%\rust-setup.ps1, dropped VBS or helper executables.
  • Network indicators: traffic to 23.254.165.112 (observed on ports 9089 and 443).

If you installed any of the affected releases during the exposure window (roughly an hour-and-a-half), assume compromise until proven otherwise — treat it like stepping on a banana peel in a crowded server room.

Practical cleanup and recovery steps

Keep calm and follow a checklist. The steps below are blunt but necessary.

  1. Hunt: search your repositories and CI artifacts for any dependency on proc-macro1 or unexpected versions of arrayref/append-only-vec/internment. Inspect Cargo.lock files and build logs.
  2. Detect: look for the dropped files (e.g., /tmp/rust-setup, %TEMP%\rust-setup.ps1) and any odd startup entries (Registry Run, LaunchAgent plists, systemd units). Check outbound connections to 23.254.165.112 on ports 9089 and 443.
  3. Assume breach: if you find signs of execution, immediately rotate credentials — change passwords, revoke CI tokens, rebuild signing keys, and replace any secrets that could have leaked.
  4. Rebuild: restore systems and build environments from known-good backups or rebuild from scratch after cleaning secrets. Don’t reuse potentially compromised tokens or keys.
  5. Contain: pin your projects to trusted, verified dependency versions (avoid floating to new releases until the maintainer situation is settled).
  6. Share: notify your team and users if you find evidence of compromise so they can take the same precautions.

This incident is a reminder that even compilation time can be a dangerous place — malicious code can hide in dependencies and execute automatically. Treat build-time dependencies as you would runtime ones: with a healthy dose of suspicion and good hygiene.