Supply-chain breach injects malware into popular Rust packages, targeting developers' credentials
Malicious code was slipped into several widely used Rust crates, turning normal builds into a conduit for credential-stealing malware.
After receiving a tip about a crate named proc-macro1, the Rust Security Response Team announced a supply-chain attack that inserted malware into the build process of several Rust packages. The attacker added proc-macro1 as a dependency to a new version of the widely used arrayref crate and also published malicious releases of internment and append-only-vec, all maintained by the same developer whose account was later locked.
Each poisoned version was available on crates.io for only 86 to 107 minutes before being taken down, yet the packages have amassed roughly 245 million and 4 million downloads respectively over their lifetimes. Aikido’s analysis showed the malicious build script fetched platform-specific payloads for Linux, Windows, Intel Macs and Apple Silicon, then harvested browser profiles, extension storage for crypto wallets, and established persistence with command-and-control capabilities.
The Rust team removed additional crates—proc-macro-en, aovine, arone, aronenao, and tinymember—and warned developers to audit lockfiles and local caches. Nextron Systems’ researchers initially uncovered the breach, though the exact method of the maintainer’s credential compromise remains unknown.
Why it matters
Developers using Rust may have unintentionally installed malware that can steal credentials and browser data.
In this story
