The Rust Security Response Team disclosed a supply-chain attack involving several packages published to crates.io, Rust’s official package registry for reusable Rust libraries, including a malicious release of the popular arrayref crate.
The incident came to light on August 20 after the team received a report that a crate named proc-macro1 was malicious. Investigation confirmed its build script downloaded a malicious payload during the build process.
The team subsequently identified and removed proc-macro1 along with several similarly named malicious crates, including proc-macro-en, aovine, arone, aronenao, and tinymember.
More significantly, investigators discovered that arrayref, a well-established Rust crate, was recently republished as version 0.3.10 with a dependency on the malicious proc-macro1 package. At the same time, legitimate recent versions of arrayref were yanked, steering users toward the compromised release.
The Rust team removed arrayref 0.3.10 and restored the legitimate versions that had been yanked. Two other crates by the same author, internment and append-only-vec, were also affected. The team removed their compromised releases and locked the maintainer’s crates.io account as a precaution.
Importantly, the Rust Security Response Team does not believe the arrayref author was responsible for the attack. Instead, the team currently assumes the maintainer’s computer or account credentials were compromised, as it is trying to contact the author.
The malicious packages were available for a short period but long enough that developers are advised to check if they were downloaded locally. arrayref 0.3.10 was on crates.io for 86 minutes before removal, internment 0.8.7 for 90 minutes, and append-only-vec 0.1.9 for 107 minutes.
In addition, every version of proc-macro1, proc-macro-en, aovine, arone, aronenao, and tinymember should also be considered malicious.
Finally, the Rust team credited the Research Team at Nextron Systems GmbH with initially discovering and reporting the incident. For additional details, see the official announcement on Rust’s blog.
