Hackers injected malware into several popular Rust packages, including arrayref, internment, and append-only-vec, by compromising a developer's credentials and publishing poisoned versions that fetched second-stage malware capable of stealing browser data, cryptocurrency wallet information, and establishing persistent remote access. The malicious releases were live for under two hours before the Rust Security Response Team removed them, though arrayref's roughly 245 million lifetime downloads highlights the potential reach of such an attack. Developers have been advised to audit their Cargo lockfiles and local registry caches for the affected packages.
