maliciousCovers 0.3.10Reviewed by BitbisonUpdated 2026-10-15
In 2026, a hijacked arrayref release pulled in a dependency that ran malware during the build.
A new dependency executed malware during compilation
arrayref is a Rust library for working with fixed-size array references.
On August 20, 2026, an attacker published version 0.3.10 with a dependency that
downloaded and executed malware during compilation. This account explains how
the dependency reached builds and what Bitbison detected in a lab reproduction.
The release appeared at 07:15 Coordinated Universal Time (UTC) through the
maintainer's account. The
Rust Security Response Team
assessed that the maintainer's computer or credentials were likely compromised.
Following a report from Nextron Systems, crates.io removed the release at
08:41:40 UTC, about 86 minutes after publication. The team also removed
internment 0.8.7 and append-only-vec 0.1.9 from the same account.
The added dependency, proc-macro1, imitated the name of the legitimate
proc-macro2 crate. Its build.rs script ran automatically when Cargo, Rust's
package manager, built the dependency. The script downloaded a program with
server certificate verification disabled. On Linux it saved the program to
/tmp/rust-setup and launched it while allowing the build to complete. Wiz
researchers Rami McCarthy and Benjamin Read documented the program's ability
to install a systemd user service and receive commands from an
attacker-controlled server. Building the dependency was sufficient to start
the attack.
Builds could select the malicious release
The attacker also yanked arrayref versions 0.3.5 through 0.3.9, as recorded in
Anders Jensen's incident timeline.
When Cargo chooses dependency versions for a new lockfile, it
skips yanked releases.
A new lockfile or dependency update could therefore select 0.3.10 if the
project's version requirements allowed it. Builds that retained an unaffected
arrayref version in Cargo.lock avoided this dependency change.
RustSec recorded 2,285 downloads
of arrayref 0.3.10 before removal. That count does not establish how many
systems executed the malicious build script.
Bitbison traced the reproduced attack through the build
We reproduced the download and execution sequence using synthetic crates and a
substitute program. The
recorded run
contains four findings:
- The
proc-macro1 build script invoked curl to download a file from a
remote host.
- The build script executed the downloaded file as
rust-setup.
rust-setup read a fixture file named .cargo/credentials.toml.- Bitbison linked that read to an outbound connection and raised a possible
credential exposure alert.
The available fixture source reads and discards the fake credential contents.
Its request body is the fixed message hello world followed by a newline.
The exposure alert therefore must not be read as proof that credential bytes
were transmitted. A separate pipe variant sends a fake credential through
cat and curl; the run linked here uses the download-and-execute variant.
Use the detections below to inspect the recorded activity.
References
