---
title: "arrayref, internment, append-only-vec: Rust Crates Hijacked"
url: https://erroneo.us/security/briefs/arrayref-crates-io-proc-macro1-build-script-malware/
description: "A hijacked crates.io account pushed arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 with a build-time dropper. Check builds from Aug 20, 2026."
type: security-brief
section: "Security Digest"
date_published: 2026-08-20
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: []
severity: "high"
exploited: "in-the-wild"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# arrayref, internment, append-only-vec: Rust Crates Hijacked

**Verdict: Check exposure.** Only builds that resolved the three poisoned releases during a roughly two-hour window on August 20, 2026 ran the payload, but any machine that did should be treated as compromised.

- **Who must act:** Rust developers and CI pipelines that ran cargo update, cargo add, or an unlocked build that pulled arrayref, internment or append-only-vec between about 07:11 and 09:25 UTC on August 20, 2026.
- **Who can relax:** Projects whose committed Cargo.lock kept arrayref at 0.3.9 or earlier, internment at 0.8.6 or earlier and append-only-vec at 0.1.8 or earlier and built with --locked; RustSec says most users stayed on older versions.
- **Affected:** arrayref 0.3.10 (RUSTSEC-2026-0260); internment 0.8.7 (RUSTSEC-2026-0266); append-only-vec 0.1.9 as published Aug 20, 2026 (RUSTSEC-2026-0262); proc-macro1, proc-macro-en, aovine, arone, aronenao (attacker crates, all versions)
- **Fixed:** No patched release; malicious versions deleted from crates.io; arrayref 0.3.9 and earlier (unaffected); internment 0.8.6 and earlier (unaffected); append-only-vec 0.1.8 and earlier (unaffected)
- **CVEs:** none
- **CISA KEV:** no · **Exploitation:** Exploited in the wild

## What to do

1. Search every Cargo.lock for proc-macro1, proc-macro-en, arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9.
2. Search ~/.cargo/registry/cache, CI caches and vendor/ directories for the deleted .crate files.
3. Treat any machine or runner that built an affected project as compromised: rotate SSH keys, cloud and CI secrets, crates.io tokens, signing keys and browser-saved passwords.
4. Rebuild artifacts produced on exposed hosts from a clean environment.
5. Pin the last clean versions and build with cargo build --locked so a sudden yank cannot pull in a new release.

### How to check if you are affected

- Look for /tmp/rust-setup on Linux and macOS, or rust-setup.ps1 and rust-setup-launch.vbs in %TEMP% on Windows.
- Check egress and DNS logs for 23.254.165.112 (ports 9089 and 443), 23.254.167.107, 23.254.167.216 and hwsrv-798836.hostwindsdns.com.
- Hunt for unfamiliar systemd user services, LaunchAgents or HKCU Run keys created on or after August 20, 2026.
- Review CI logs from 07:11 to 09:25 UTC on August 20, 2026 for jobs that resolved new crate versions.

## What happened

On August 20, 2026, the Rust Security Response Team [reported](https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/) a supply chain attack on crates.io. A new crate, `proc-macro1`, impersonated David Tolnay's `proc-macro2`. Its library code was a working copy, but its `build.rs` downloaded and ran a remote binary. The attacker then republished three crates owned by the `droundy` account: `arrayref` 0.3.10, `internment` 0.8.7 and `append-only-vec` 0.1.9. Each one added a single new dependency on the malicious crate. The Rust team says it does not believe the author acted maliciously and thinks the author's computer or credentials were likely compromised. The account is locked.

The attacker also yanked the clean `arrayref` releases 0.3.5 through 0.3.9. According to [StepSecurity](https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack), this happened in a scripted burst seconds after publishing. As a result, Cargo's "consider updating to a version that is not yanked" hint pointed users at the poisoned release. Nextron Systems reported the issue. The team deleted the malicious versions after 86, 90 and 107 minutes, deleted `proc-macro1`, `proc-macro-en`, `aovine`, `arone`, `aronenao` and `tinymember`, and reversed the fake yanks. [RUSTSEC-2026-0260](https://rustsec.org/advisories/RUSTSEC-2026-0260.html) says `arrayref` 0.3.10 was downloaded 2,285 times, less than 10% of `arrayref` download traffic across all versions. No CVE was assigned.

## Who is affected

Exposure comes from builds, not from calling code. Any `cargo build`, `check` or `test` that resolved one of the three releases ran the dropper with the user's privileges. On Linux and macOS it wrote `/tmp/rust-setup`. On Windows it launched a hidden PowerShell script through `wscript.exe`. In both cases it passed `23.254.165.112:443` as its command-and-control address. [Wiz](https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns) found that the second stage persists through systemd user services, LaunchAgents or Run keys, enumerates browser saved-login and extension stores, and runs follow-on scripts. Wiz also reports that the infrastructure substantially overlaps with recent North Korea-attributed npm attacks. No vendor has formally attributed this incident. `arrayref` is a deep transitive dependency, so many projects that never list it directly could have pulled it in through a caret range.

## Do you really need to act?

Most teams only need a quick check. The window was short, and a committed `Cargo.lock` protects you: RustSec notes that most users already had older versions locked. You are at risk if a developer or CI job ran `cargo update` or `cargo add`, or built without a lockfile, between about 07:11 and 09:25 UTC on August 20. Followed a yank warning that morning? Same answer. `cargo audit` may report clean for versions that have since been deleted, so it is not enough on its own. Cached or vendored copies can still build the payload offline. One complication: on October 18, 2026, the owner account published a new `append-only-vec` 0.1.9 on [crates.io](https://crates.io/crates/append-only-vec), and its listed dependencies do not include `proc-macro1`. Match lockfile checksums, not just version numbers. [OSV's malicious-package record](https://osv.dev/vulnerability/MAL-2026-14336) lists the same indicators.

## What to do now

1. Grep lockfiles: `grep -rEn 'proc-macro1|proc-macro-en|aovine|arone|aronenao' --include=Cargo.lock .`. Then check the resolved versions of `arrayref`, `internment` and `append-only-vec` with `cargo tree -i arrayref`.
2. Search caches: `find ~/.cargo/registry/cache -name 'arrayref-0.3.10.crate' -o -name 'internment-0.8.7.crate' -o -name 'proc-macro1-*.crate'`. Repeat for CI cache volumes and `vendor/`.
3. If a hit ran a build, treat the host as compromised. Rotate SSH keys, cloud and CI secrets, crates.io tokens and signing keys. Reset browser-saved passwords, then reimage or rebuild runners.
4. Pin clean versions (`arrayref = "=0.3.9"`, `internment = "=0.8.6"`, `append-only-vec = "=0.1.8"`) or newer verified releases, commit the lockfile, and build with `cargo build --locked`.
5. Treat a sudden yank of several stable versions as a warning sign. Don't follow it blindly.

## How to tell if you were hit

Look for `/tmp/rust-setup`, or for `rust-setup.ps1` and `rust-setup-launch.vbs` in `%TEMP%`. Search egress logs for `23.254.165.112` on ports 9089 and 443, plus `23.254.167.107`, `23.254.167.216` and `hwsrv-798836.hostwindsdns.com`. Check for new systemd user services, LaunchAgents or HKCU Run entries. StepSecurity also relays unverified third-party reports of `~/.config/AzureKits` and `~/.config/ServiceKit` directories on infected Linux hosts. Its write-up and Wiz's list file hashes for the recoverable crates.

## Timeline

- Aug 18, 2026 — Attacker-owned crates `arone` and `aronenao` receive their final publishes (per StepSecurity).
- Aug 20, 2026 — 07:11 UTC: `proc-macro1` 1.0.107 goes live. 07:15 to 07:37 UTC: the three hijacked releases are published. 08:41 to 09:25 UTC: all three are deleted. Advisories RUSTSEC-2026-0260, -0262 and -0266 follow, along with the Rust blog post and the [first press coverage](https://thehackernews.com/2026/08/rust-supply-chain-attack-puts-build.html).
- Aug 21, 2026 — RustSec updates its advisories with download figures from crates.io logs.
- Oct 18, 2026 — The owner account publishes a new `append-only-vec` 0.1.9, followed by 0.1.10 on Oct 19.

## Sources

1. [Rust Blog (Security Response Team) — Supply chain attack on arrayref](https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/)
2. [RustSec — RUSTSEC-2026-0260: arrayref 0.3.10 removed due to a malicious dependency](https://rustsec.org/advisories/RUSTSEC-2026-0260.html)
3. [RustSec — RUSTSEC-2026-0266: internment 0.8.7 removed due to a malicious dependency](https://rustsec.org/advisories/RUSTSEC-2026-0266.html)
4. [RustSec — RUSTSEC-2026-0262: append-only-vec 0.1.9 removed due to a malicious dependency](https://rustsec.org/advisories/RUSTSEC-2026-0262.html)
5. [OSV — MAL-2026-14336: Malicious code in arrayref](https://osv.dev/vulnerability/MAL-2026-14336)
6. [crates.io — append-only-vec](https://crates.io/crates/append-only-vec)
7. [Wiz — Rust supply chain attack on arrayref: significant overlap with DPRK campaigns](https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns)
8. [StepSecurity — arrayref Rust crate supply chain attack](https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack)
9. [The Hacker News — Rust supply chain attack puts build-time malware in crates with 245 million downloads](https://thehackernews.com/2026/08/rust-supply-chain-attack-puts-build.html)

---
Source page: https://erroneo.us/security/briefs/arrayref-crates-io-proc-macro1-build-script-malware/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt