Attackers hijacked the maintainer account behind arrayref, a popular Rust library with over 245 million lifetime downloads, and injected malware that executes silently when developers compile their code. Within a 23-minute window on August 20, the same attacker also poisoned two related crates — append-only-vec and internment — in what security researchers at StepSecurity and Wiz are calling a coordinated supply chain attack with infrastructure overlapping known North Korean (DPRK) campaigns.
The attack worked by injecting a dependency on proc-macro1, a typosquat of the legitimate proc-macro2 crate, while leaving the rest of the source code intact to avoid detection. A build script embedded in that fake package wrote a binary to /tmp/rust-setup, marked it executable, and launched it as a detached process. The malware then raided credential databases from Google Chrome, Brave, and Microsoft Edge — the kind of silent, compile-time compromise that bypasses most standard code-review processes. Projects using arrayref include blake3, the Rust GUI frameworks egui, eframe, and iced, and components used in Ethereum and Solana tooling.
How to check if you’re affected
Affected versions of arrayref, append-only-vec, and internment are those installed from crates.io during the exposure window beginning at approximately 01:17 UTC on August 20, 2026. Check your Cargo.lock file and compare the publish timestamps on crates.io for each package. If you installed any of these crates during that window, treat your build environment as compromised: rotate all accessible credentials, CI/CD tokens, signing keys, and secrets, then rebuild from a trusted snapshot.