Rust Project deletes three malicious crates after compromised account hits 245 million downloads
This digest was compiled by AI from multiple sources — links to the originals are below.
The Rust Project removed three malicious crate releases from crates.io on August 20 after a compromised maintainer account injected a build script that downloaded and executed a remote payload. The deleted versions — arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 — were online for 86 to 107 minutes and came from crates with a combined 245 million downloads. The Rust Security Response Team is advising developers to pin arrayref to 0.3.9 or earlier and search cargo cache directories for the deleted files.
Key Facts
- The Rust Security Response Team deleted arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 from crates.io on August 20, 2026 after receiving a report at 07:15 UTC.
- Each compromised release added only one line to its manifest — a dependency on proc-macro1, a typosquat of the widely used proc-macro2 crate.
- The malicious versions were online for 86 minutes, 90 minutes, and 107 minutes respectively before the Rust team removed them.
- RUSTSEC-2026-0260, the advisory for arrayref, records that the compromised version was published on 2026-08-20 and removed approximately 86 minutes later with no evidence of actual usage.
- The Rust Security Response Team named Nextron Systems GmbH as the initial discoverer and said arrayref maintainer David Roundy's credentials were likely compromised, not malicious.
The Malicious Crate Releases
The Rust Project removed arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 from crates.io on August 20, 2026, after a compromised maintainer account published them with an added dependency on proc-macro1. The malicious dependency's build script downloaded and executed a remote payload during compilation, so merely building a project that resolved the dependency was enough to run the code. The compromised releases were online for 86 minutes, 90 minutes, and 107 minutes respectively, according to deletion timestamps published by the Rust Security Response Team. No patched version of any crate exists, no CVE identifier has been assigned, and the RustSec advisories record no evidence that any malicious version was used. The sole listed owner of arrayref is user 2402, David Roundy, registered in October 2009.
Security Response and Remediation
The Rust Security Response Team received a report at 07:15 UTC on August 20 that the proc-macro1 crate was malicious and verified that it carried a build script downloading a malicious payload. The team credited the Research Team at Nextron Systems GmbH with initially discovering and reporting the malicious crate. Developers are advised to search ~/.cargo/registry/cache for the deleted crate files and to pin arrayref at 0.3.9 or earlier. The Rust Security Response Team said it unyanked the maliciously-yanked arrayref versions during the response, and said it does not believe the author of arrayref acted maliciously. The account compromise method has not been disclosed, and The Hacker News had not received a response from the team on the basis for the no-usage finding or the download count of the deleted versions.
1 source
Rust Project deletes three malicious crates after compromised account hits 245 million downloads
