arrayref, internment, append-only-vec: Rust Crates Hijacked

What to do

1. Search every Cargo.lock for proc-macro1, proc-macro-en, arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9.
2. Search ~/.cargo/registry/cache, CI caches and vendor/ directories for the deleted .crate files.
3. Treat any machine or runner that built an affected project as compromised: rotate SSH keys, cloud and CI secrets, crates.io tokens, signing keys and browser-saved passwords.
4. Rebuild artifacts produced on exposed hosts from a clean environment.
5. Pin the last clean versions and build with cargo build --locked so a sudden yank cannot pull in a new release.

How to check if you are affected or compromised

• Look for /tmp/rust-setup on Linux and macOS, or rust-setup.ps1 and rust-setup-launch.vbs in %TEMP% on Windows.
• Check egress and DNS logs for 23.254.165.112 (ports 9089 and 443), 23.254.167.107, 23.254.167.216 and hwsrv-798836.hostwindsdns.com.
• Hunt for unfamiliar systemd user services, LaunchAgents or HKCU Run keys created on or after August 20, 2026.
• Review CI logs from 07:11 to 09:25 UTC on August 20, 2026 for jobs that resolved new crate versions.

What happened#

On August 20, 2026, the Rust Security Response Team reported a supply chain attack on crates.io. A new crate, proc-macro1, impersonated David Tolnay's proc-macro2. Its library code was a working copy, but its build.rs downloaded and ran a remote binary. The attacker then republished three crates owned by the droundy account: arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9. Each one added a single new dependency on the malicious crate. The Rust team says it does not believe the author acted maliciously and thinks the author's computer or credentials were likely compromised. The account is locked.

The attacker also yanked the clean arrayref releases 0.3.5 through 0.3.9. According to StepSecurity, this happened in a scripted burst seconds after publishing. As a result, Cargo's "consider updating to a version that is not yanked" hint pointed users at the poisoned release. Nextron Systems reported the issue. The team deleted the malicious versions after 86, 90 and 107 minutes, deleted proc-macro1, proc-macro-en, aovine, arone, aronenao and tinymember, and reversed the fake yanks. RUSTSEC-2026-0260 says arrayref 0.3.10 was downloaded 2,285 times, less than 10% of arrayref download traffic across all versions. No CVE was assigned.

Who is affected#

Exposure comes from builds, not from calling code. Any cargo build, check or test that resolved one of the three releases ran the dropper with the user's privileges. On Linux and macOS it wrote /tmp/rust-setup. On Windows it launched a hidden PowerShell script through wscript.exe. In both cases it passed 23.254.165.112:443 as its command-and-control address. Wiz found that the second stage persists through systemd user services, LaunchAgents or Run keys, enumerates browser saved-login and extension stores, and runs follow-on scripts. Wiz also reports that the infrastructure substantially overlaps with recent North Korea-attributed npm attacks. No vendor has formally attributed this incident. arrayref is a deep transitive dependency, so many projects that never list it directly could have pulled it in through a caret range.

Do you really need to act?#

Most teams only need a quick check. The window was short, and a committed Cargo.lock protects you: RustSec notes that most users already had older versions locked. You are at risk if a developer or CI job ran cargo update or cargo add, or built without a lockfile, between about 07:11 and 09:25 UTC on August 20. Followed a yank warning that morning? Same answer. cargo audit may report clean for versions that have since been deleted, so it is not enough on its own. Cached or vendored copies can still build the payload offline. One complication: on October 18, 2026, the owner account published a new append-only-vec 0.1.9 on crates.io, and its listed dependencies do not include proc-macro1. Match lockfile checksums, not just version numbers. OSV's malicious-package record lists the same indicators.

What to do now#

1. Grep lockfiles: grep -rEn 'proc-macro1|proc-macro-en|aovine|arone|aronenao' --include=Cargo.lock .. Then check the resolved versions of arrayref, internment and append-only-vec with cargo tree -i arrayref.
2. Search caches: find ~/.cargo/registry/cache -name 'arrayref-0.3.10.crate' -o -name 'internment-0.8.7.crate' -o -name 'proc-macro1-*.crate'. Repeat for CI cache volumes and vendor/.
3. If a hit ran a build, treat the host as compromised. Rotate SSH keys, cloud and CI secrets, crates.io tokens and signing keys. Reset browser-saved passwords, then reimage or rebuild runners.
4. Pin clean versions (arrayref = "=0.3.9", internment = "=0.8.6", append-only-vec = "=0.1.8") or newer verified releases, commit the lockfile, and build with cargo build --locked.
5. Treat a sudden yank of several stable versions as a warning sign. Don't follow it blindly.

How to tell if you were hit#

Look for /tmp/rust-setup, or for rust-setup.ps1 and rust-setup-launch.vbs in %TEMP%. Search egress logs for 23.254.165.112 on ports 9089 and 443, plus 23.254.167.107, 23.254.167.216 and hwsrv-798836.hostwindsdns.com. Check for new systemd user services, LaunchAgents or HKCU Run entries. StepSecurity also relays unverified third-party reports of ~/.config/AzureKits and ~/.config/ServiceKit directories on infected Linux hosts. Its write-up and Wiz's list file hashes for the recoverable crates.

Timeline#

• Aug 18, 2026 — Attacker-owned crates arone and aronenao receive their final publishes (per StepSecurity).
• Aug 20, 2026 — 07:11 UTC: proc-macro1 1.0.107 goes live. 07:15 to 07:37 UTC: the three hijacked releases are published. 08:41 to 09:25 UTC: all three are deleted. Advisories RUSTSEC-2026-0260, -0262 and -0266 follow, along with the Rust blog post and the first press coverage.
• Aug 21, 2026 — RustSec updates its advisories with download figures from crates.io logs.
• Oct 18, 2026 — The owner account publishes a new append-only-vec 0.1.9, followed by 0.1.10 on Oct 19.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Rust Blog (Security Response Team) — Supply chain attack on arrayref blog.rust-lang.org
2. RustSec — RUSTSEC-2026-0260: arrayref 0.3.10 removed due to a malicious dependency rustsec.org
3. RustSec — RUSTSEC-2026-0266: internment 0.8.7 removed due to a malicious dependency rustsec.org
4. RustSec — RUSTSEC-2026-0262: append-only-vec 0.1.9 removed due to a malicious dependency rustsec.org
5. OSV — MAL-2026-14336: Malicious code in arrayref osv.dev
6. crates.io — append-only-vec crates.io
7. Wiz — Rust supply chain attack on arrayref: significant overlap with DPRK campaigns wiz.io
8. StepSecurity — arrayref Rust crate supply chain attack stepsecurity.io

Coverage and analysis

1. The Hacker News — Rust supply chain attack puts build-time malware in crates with 245 million downloads thehackernews.com