Part of: Wiz links North Korea to backdoored arrayref and two other Rust crates·3 events

Hackers compromise arrayref Rust crate to distribute infostealer malware

AI digestMimile.ai EditorialAugust 20, 2026 at 10:53 PM

This digest was compiled by AI from multiple sources — links to the originals are below.

Hackers compromise arrayref Rust crate to distribute infostealer malware

Hackers compromise the maintainer account behind the widely used Rust crate arrayref and publish malicious release 0.3.10. The same account also distributes poisoned versions of append-only-vec and internment within a 23-minute window on August 20. The malicious build script targets credentials in Chrome, Brave and Edge browsers and establishes persistence on Windows, macOS and Linux.

Key Facts

arrayref 0.3.10 was published at 07:15 UTC on August 20 through the legitimate droundy (David Roundy) maintainer account.
arrayref has more than 53 million downloads in the past 90 days and over 245 million lifetime downloads.
The attacker also published poisoned versions of append-only-vec 0.1.9 and internment 0.8.7 within a 23-minute window.
The payload targets Linux x86-64, Windows x86-64, macOS x86-64, and macOS ARM64 and establishes persistence via Registry Run, LaunchAgent, or systemd.
The malware collects credentials from Google Chrome, Brave, and Edge browsers by querying SQLite login databases.

Compromise Timeline

At 01:17 UTC on August 20, a GitHub account impersonating prominent Rust developer David Tolnay was created, followed by a similar account in the crates.io registry. At 01:55, the attacker published [email protected], a benign copy of proc-macro2, followed by a malicious update through version 1.0.107 published at 07:11. At 07:15, arrayref 0.3.10 was published through the legitimate droundy (David Roundy) account, and versions 0.3.5 through 0.3.9 were removed. The attacker also published versions of four crates — aovine, arone, aronenao, and tinymember — that have been removed from crates.io.

Malware Capabilities

The malicious crate added a dependency on proc-macro1, a typosquat impersonating the popular proc-macro2 crate, while leaving the rest of the upstream source code unchanged. A script named build.rs in proc-macro1 executes automatically during compilation, reconstructing its infrastructure from base64-encoded fragments and selecting a payload for Linux x86-64, Windows x86-64, macOS x86-64, or macOS ARM64. On Unix systems, the malware writes /tmp/rust-setup, marks it executable, and launches it as a detached process; on Windows, it creates %TEMP%\rust-setup.ps1 and uses a hidden wscript.exe and VBS launcher. An analysis by cloud security company Wiz describes second-stage capabilities that include exfiltrating host information and credentials from Google Chrome, Brave, and Edge by querying SQLite login databases. Persistence is established via the Registry Run key on Windows, LaunchAgent on macOS, and systemd on Linux.

Project Impact

arrayref has more than 53 million downloads in the past 90 days and over 245 million lifetime downloads. The append-only-vec and internment crates have a collective lifetime download count of nearly 19 million installations. Projects using arrayref include the blake3 hash function, Rust GUI frameworks egui, eframe, and iced, and components used in Ethereum and Solana.

1 source

Hackers compromise arrayref Rust crate to distribute infostealer malware

bleepingcomputer.com

BleepingComputer

Politics

Rust Project deletes three malicious crates after compromised account hits 245 million downloads

The Rust Project removed three malicious crate releases from crates.io on August 20 after a compromised maintainer account injected a build script that downloaded and executed a remote payload. The deleted versions — arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 — were online for 86 to 107 minutes and came from crates with a combined 245 million downloads. The Rust Security Response Team is advising developers to pin arrayref to 0.3.9 or earlier and search cargo cache directories for the deleted files.

Technology

Wiz links North Korea to backdoored arrayref and two other Rust crates

Malicious versions of three Rust packages, including arrayref, were published to crates.io on August 20 with a build-time backdoor. The packages pulled a typosquatted dependency, proc-macro1, that downloaded and executed a second-stage payload during compilation. Wiz and StepSecurity linked the infrastructure to North Korean threat actors.

Technology

iAuthFlow v2 malware adds attacker passkeys to hijacked email accounts

Security researchers at Abnormal discovered iAuthFlow v2, a malware toolkit sold on Russian forums for over $10,000 that lets attackers regain access to compromised email accounts even after password resets. The tool phishes credentials from Google, Microsoft, iCloud, or LinkedIn, then silently creates an attacker-controlled passkey. Abnormal advises users to audit passkeys, OAuth tokens, mail rules, and remove rogue authentication methods.

Technology

CrowdStrike finds worm targeting AI software supply chain

CrowdStrike researchers discovered a worm that targets AI software supply chains, stealing credentials and sensitive data while evading detection. The malware mimics legitimate AI coding activity, making it difficult to identify. The attack reflects a growing trend of adversaries exploiting AI toolchains.

Hackers compromise arrayref Rust crate to distribute infostealer malware

Key Facts

Compromise Timeline

Malware Capabilities

Project Impact

Read more

Read more