{"slug": "popular-rust-crates-compromised-in-build-time-supply-chain-attack", "title": "Popular Rust Crates Compromised in Build-Time Supply Chain Attack", "summary": "Socket's Threat Research Team detected a coordinated supply chain attack on August 20, 2026, in which three legitimate Rust crates—arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9—were republished with a malicious dependency, proc-macro1, that executed cross-platform malware during Cargo builds. The Rust Security Response Team removed the affected releases and locked the maintainer account, suspecting the maintainer's credentials were compromised. The attack provided build-time remote code execution across Linux, macOS, and Windows, with stage-2 payloads acting as a cross-platform backdoor.", "body_md": "Back\n[Research]\n[Security News]\nPopular Rust Crates Compromised in Build-Time Supply Chain Attack\nThree compromised Rust crates pulled in a malicious dependency that downloaded and executed cross-platform malware during Cargo builds.\nSocket Research Team\nAug 20, 2026\n|\n5 min read\nA threat actor compromised legitimate Rust crates and injected a malicious \nproc-macro1\n dependency that executed cross-platform malware automatically during Cargo builds.\nSocket’s Threat Research Team analyzed a coordinated supply chain attack affecting three legitimate Rust crates maintained by David Roundy (\ndroundy\n):\narrayref@0.3.10\ninternment@0.8.7\nappend-only-vec@0.1.9\nSocket’s AI Scanner independently detected the malicious \nproc-macro1\n crate on August 20, 2026 at 07:29:50 UTC. At that point only \narrayref@0.3.10\n had been republished with the malicious dependency; malicious \ninternment@0.8.7\n and \nappend-only-vec@0.1.9\n were published minutes later. Our subsequent analysis of the affected and related crates and recovered malware payloads confirmed the broader attack. Separately, researchers at Nextron Systems reported the activity to the Rust Security Response Team, with technical details also \ndisclosed\n through RustSec.\nEach malicious release added a dependency on \nproc-macro1\n, a threat actor-controlled typosquat impersonating the widely used \nproc-macro2\n crate.\nThe Rust Security Response Team promptly \nremoved\n the affected releases and locked the maintainer account as a precaution. The team stated that it does not believe the legitimate maintainer acted maliciously and suspects that the maintainer’s computer or \ncrates.io\n publishing credentials were compromised, allowing the threat actor to publish malicious versions of \narrayref\n, \ninternment\n, and \nappend-only-vec\n.\nWe recommend treating any system that built one of these malicious versions as potentially compromised.\nThe Attack\n#\nThe compromised crates themselves contained little obviously malicious code. Instead, their manifests added:\nRust\n\n```\nproc-macro1 = \"1.0.107\"\n```\n\nWhen Cargo resolves the dependency, it downloads \nproc-macro1\n and automatically executes its \nbuild.rs\n during compilation. The application does not need to import or call any malicious functionality.\nproc-macro1\n closely impersonates the legitimate \nproc-macro2\n, including copied source code, documentation, metadata, and a deceptive publisher identity. The legitimate-looking library code acts as camouflage while the malicious behavior resides in \nbuild.rs\n.\nThe loader:\nReconstructs Base64-obfuscated C2 addresses.\nDetects the victim OS and architecture.\nDisables TLS certificate verification.\nDownloads a platform-specific payload from \n23[.]254[.]165[.]112:9089\n.\nExecutes it while passing \n23[.]254[.]165[.]112:443\n as a C2 endpoint.\nRustSec \ndocumented\n the malicious dependency and build script behavior.\nCross-Platform Execution\n#\nOn Linux and macOS, the malware writes:\nRust\n\n```\n/tmp/rust-setup\n```\n\nIt makes the file executable and launches it detached.\nOn Windows, it creates:\nRust\n\n```\n%TEMP%\\rust-setup.ps1\n%TEMP%\\rust-setup-launch.vbs\n```\n\nIt then uses \nwscript.exe\n to launch hidden PowerShell with \nExecutionPolicy Bypass\n, allowing the malicious process to continue independently of Cargo.\nThe attack therefore provides build-time remote code execution across Linux, macOS, and Windows.\nStage-2 Backdoor Capabilities\n#\nWe analyzed three recovered stage-2 payloads for Linux x86-64, Windows x86-64, and macOS ARM64. Despite different implementations, the recovered samples share the same protocol, configuration structure, command set, and cryptographic key material, confirming they are variants of the same cross-platform backdoor.\nOnce executed, the malware:\nProfiles the host, including username, hostname, OS, architecture, privilege level, and installed applications.\nInventories Chromium-based browsers, collecting visited login origins, usernames, and installed extension identifiers. The analyzed stage does \nnot\n decrypt stored passwords.\nEstablishes user-level persistence through an HKCU Run key on Windows, a systemd user service on Linux, or a LaunchAgent on macOS.\nBeacons to \n/49890878\n and supports C2 commands to change configuration, establish persistence, download and execute scripts or shell commands, and terminate the implant.\nFalls back to ten deterministic, date-based \n.com\n domains when the primary C2 is unavailable and permanently adopts a responsive fallback.\nThe stage-2 payloads do not embed \n23[.]254[.]165[.]112\n. Instead, \nproc-macro1\n passes the C2 address to the payload at execution time, allowing the threat actor to rotate infrastructure without rebuilding the implants. Socket also found little meaningful anti-analysis or obfuscation beyond the Base64-split infrastructure in the stage-1 loader.\nOur analysis additionally identified a weakness in the backdoor’s command-authentication design. The same RSA private key is embedded across the recovered payloads, and the implementation does not provide exclusive operator authentication. Combined with the predictable DGA, this creates additional opportunities for defensive sinkholing and victim identification, although defenders should not issue commands to third-party systems.\nCoordinated Compromise of Legitimate Crates\n#\nSocket confirmed that the malicious versions of all three legitimate crates introduced the same \nproc-macro1\n dependency:\nAll were published within minutes of one another on August 20, 2026, shortly after \nproc-macro1\n appeared.\nThe threat actor also \nyanked\n several older legitimate \narrayref\n releases, potentially steering new dependency resolution toward malicious \n0.3.10\n. Rust later restored the legitimate versions.\nBroader Attacker Infrastructure\n#\nproc-macro-en@1.0.10\n contained the same malicious \nbuild.rs\n as \nproc-macro1@1.0.107\n, while Socket’s analysis of \naovine\n, \narone\n, and \naronenao\n found benign or test-like build scripts consistent with staging activity.\nRust also removed:\nproc-macro-en\naovine\narone\naronenao\ntinymember\nOur telemetry provides additional context. \naovine\n, \narone\n, and \naronenao\n appear to be threat actor-controlled clones or staging packages derived from legitimate \ndroundy\n crates. The versions Socket analyzed contained benign or test-like \nbuild.rs\n scripts rather than the final C2 loader.\ntinymember\n impersonated \ntiny-skia\n and referenced related packages, but we did not observe the active \nproc-macro1\n payload in the analyzed version.\nThese crates appear consistent with development, testing, or staging infrastructure surrounding the attack. They should still be blocked, consistent with Rust’s remediation guidance.\nDeveloper and CI/CD Impact\n#\nThe compromise occurs during compilation. A developer can be infected simply by running a normal Cargo build that resolves the malicious dependency.\nThis puts particularly sensitive environments at risk, including:\nDeveloper workstations\nCI/CD runners\nRelease infrastructure\nAutomated build systems.\nSuch systems frequently contain source-control credentials, package publishing tokens, cloud credentials, signing material, and deployment secrets.\narrayref\n is also deeply embedded in the Rust dependency ecosystem. RustSec \nnoted\n roughly 152 million downloads for the prior clean release and transitive dependency paths into widely used Rust GUI frameworks. Download counts do not represent compromised hosts, however. Exposure depends on whether a system actually resolved and built one of the malicious releases.\nRecommended Actions\n#\nOrganizations should search \nCargo.lock\n, dependency inventories, build logs, and Cargo caches for:\narrayref 0.3.10\ninternment 0.8.7\nappend-only-vec 0.1.9\nproc-macro1\nproc-macro-en\naovine\narone\naronenao\ntinymember\nPin affected legitimate crates to:\narrayref <= 0.3.9\ninternment <= 0.8.6\nappend-only-vec <= 0.1.8\nFor systems that built a malicious version:\nTreat the host as potentially compromised.\nHunt for connections to \n23[.]254[.]165[.]112\n on ports \n9089\n and \n443\n.\nHunt for user-level persistence established after the build, including \nHKCU Run\n entries, \nsystemd\n user services, and macOS LaunchAgents.\nSearch for \n/tmp/rust-setup\n, \nrust-setup.ps1\n, and \nrust-setup-launch.vbs\n.\nInvestigate suspicious \nwscript.exe\n or PowerShell execution associated with Cargo builds.\nRotate credentials and secrets accessible to affected build environments.\nRebuild affected software from a known-clean system.\nIndicators of Compromise (IOCs)\n#\nNetwork Indicators\n#\n23[.]254[.]165[.]112:9089\n23[.]254[.]165[.]112:443\nhxxps://23[.]254[.]165[.]112:443/49890878\nPayload Download URLs\n#\nhxxps://23[.]254[.]165[.]112:9089/rust-crate_0.1.0\n — Linux x86-64\nhxxps://23[.]254[.]165[.]112:9089/rust-crate_0.2.0\n — Windows x86-64\nhxxps://23[.]254[.]165[.]112:9089/rust-crate_0.3.0\n — macOS x86-64\nhxxps://23[.]254[.]165[.]112:9089/rust-crate_0.4.0\n — macOS ARM64\nStage-2 Payload SHA-256\n#\n408ef22050ffc5a67e005802809026b29f297a8019f8fda91a2afa8e877ba434\n — Linux x86-64 (\nrust-crate_0.1.0\n)\n492f2ab86f8d8911adc79c10ec1541704f5311d207d9d799b0d2a57fcc6a4391\n — Windows x86-64 (\nrust-crate_0.2.0\n)\nc9561a3b00a0fa38b7772675d987f84bd429c55cd024fc08a98245c2d1632848\n — macOS x86-64 (\nrust-crate_0.3.0\n)\n74d3447e7cf99c99ea01a16332ec27432dfb0f491e10e67cd118065a60483306\n — macOS ARM64 (\nrust-crate_0.4.0\n)\nMalicious Loader SHA-256\n#\ncb7778eb6dda91028abf087eb7c3553f981a67e756769507d348e8c201805568\n — \nbuild.rs\n shared by \nproc-macro1@1.0.107\n and \nproc-macro-en@1.0.10\nHost Artifacts\n#\n/tmp/rust-setup\n%TEMP%\\rust-setup.ps1\n%TEMP%\\rust-setup.ps1.cfg\n%TEMP%\\rust-setup-launch.vbs\n%TEMP%\\ps-<GUID>.ps1\n%APPDATA%\\<operator-controlled folder>\\<name>.ps1\n%APPDATA%\\<operator-controlled folder>\\<name>.ps1.cfg\nDGA Hunting Indicators\n#\nThe following domains are deterministically generated by the backdoor for August 20 - 24, 2026 UTC. They are hunting indicators and are not necessarily registered or active.\nrasGThauFD[.]com\nfeVVKIiEiU[.]com\nphrpjTNckF[.]com\nPrOkXLgfjW[.]com\nackeoTaWtl[.]com\nGAFWVCMAja[.]com\nRNSsddnEgK[.]com\npfHlVOqEeg[.]com\naBEcOrkups[.]com\nepOdIaTMaM[.]com\nCompromised and Threat Actor-Controlled Crates\n#\nCompromised Legitimate Crates\n#\narrayref@0.3.10\ninternment@0.8.7\nappend-only-vec@0.1.9\nThreat Actor-Controlled Crates\n#\nproc-macro1\nproc-macro-en\naovine\narone\naronenao\ntinymember", "url": "https://wpnews.pro/news/popular-rust-crates-compromised-in-build-time-supply-chain-attack", "canonical_source": "https://socket.dev/blog/popular-rust-crates-compromised?utm_medium=feed", "published_at": "2026-08-20 15:54:37+00:00", "updated_at": "2026-08-20 16:42:51.018509+00:00", "lang": "en", "topics": ["ai-research", "ai-tools"], "entities": ["Socket", "Socket Research Team", "David Roundy", "arrayref", "internment", "append-only-vec", "proc-macro1", "Rust Security Response Team"], "alternates": {"html": "https://wpnews.pro/news/popular-rust-crates-compromised-in-build-time-supply-chain-attack", "markdown": "https://wpnews.pro/news/popular-rust-crates-compromised-in-build-time-supply-chain-attack.md", "text": "https://wpnews.pro/news/popular-rust-crates-compromised-in-build-time-supply-chain-attack.txt", "jsonld": "https://wpnews.pro/news/popular-rust-crates-compromised-in-build-time-supply-chain-attack.jsonld"}}