NewsBite analysis · Programming, Security · Security Vulnerability
BleepingComputer
Hackers poison arrayref Rust crate to push infostealer malware
A coordinated supply-chain attack exploited the maintainer account of the Rust crate arrayref, leading to the introduction of malware during compilation. This incident affected two additional crates, append-only-vec and internment, and involved releasing malicious versions that could collect sensitive credentials from popular web browsers. With a substantial number of downloads for the affected crates, the implications for projects using them are significant and alarming for the Rust community.
Act nowConfidence: HighImmediate horizonCybersecurity risk: High
Published 20 Aug 2026, 18:50 UTC2 min read
Visit original article ↗Lead image — BleepingComputer
Summary
TL;DR
- Attack compromised the maintainer account of the arrayref crate.
- Malware executed on developer systems during compilation.
- In total, three crates were poisoned in the supply-chain attack.
- Malware collects credentials from web browsers through SQLite databases.
- Crates.io took action to remove the malicious versions shortly after the attack.
Interesting facts
- Arrayref alone has over 245 million lifetime downloads.
- The attack mimicked the identity of a known Rust developer.
- Exfiltration capabilities include retrieving sensitive data from multiple platforms.