Poisoned Rust Packages Spent 90 Minutes Stealing Developer Credentials Before Anyone Noticed
Someone this week managed to slip malware into several Rust packages on crates.io, turning standard build processes into a credential-harvesting operation. The Rust Security Response Team went public on Thursday after a tip came in about a suspicious crate called proc-macro1.
The attack was more than a single bad package. The real damage was done through arrayref, a well-used Rust crate with around 245 million lifetime downloads. An attacker published a new version with proc-macro1 baked in as a dependency, then yanked recent legitimate versions of arrayref to nudge developers toward the compromised release. Classic supply chain manipulation.
The Rust team doesn't think arrayref's actual maintainer was behind any of this. Their working theory is that the developer's account or machine was compromised. Two other crates maintained by the same person, internment and append-only-vec, also got poisoned versions published.
The exposure windows were tight. Arrayref 0.3.10 sat on crates.io for 86 minutes, internment 0.8.7 for 90 minutes, append-only-vec 0.1.9 for 107 minutes. Short, yes, but for a package with hundreds of millions of downloads, even a brief window during busy build hours could catch a lot of machines.
Security firm Aikido did a detailed breakdown of how the malware actually worked. The attacker barely touched the legitimate source code. The only addition was that dependency on proc-macro1, a deliberate typosquat of the legitimate proc-macro2 package. The nasty stuff lived inside proc-macro1's build.rs file.
This is where Cargo's build script behaviour becomes a problem. Cargo runs build scripts during compilation, which gave proc-macro1 an automatic execution vector. It would fingerprint the operating system and CPU architecture of whoever was building, fetch a matching payload from a remote server, and run it. Payloads were built for Linux, Windows, Intel Macs, and Apple Silicon Macs, so this wasn't a half-hearted effort.
What came down in the second stage was nastier than a simple downloader. Aikido found code targeting Chromium-based browsers including Chrome, Brave, and Edge, plus extension storage used by crypto wallets. There was also persistence functionality and command-and-control capabilities baked in.
Beyond the three compromised crates, the Rust team also deleted proc-macro-en, aovine, arone, aronenao, and tinymember, flagging every version of those as malicious. Developers are being told to audit their Cargo lockfiles and local registry caches.
Credit for the initial discovery goes to Nextron Systems' research team. What remains unclear is how the original maintainer was compromised, and crucially, how many developers actually pulled and built one of the poisoned releases during those brief windows.
Two hours is not long. But for a well-trafficked package in an active ecosystem, two hours is plenty.