Cyber Threat Intelligence, Entrepreneur, Presentation Virtuoso
articles

One Hijacked Account, One Crate, 245 Million Rust Downloads at Risk

For 86 minutes on August 20, compiling a Rust project was enough to install an infostealer, no malicious code ever called. An attacker hijacked the account behind arrayref, a tiny crate riding in three-quarters of all Rust environments. You never trusted arrayref. You trusted the account.
One Hijacked Account, One Crate, 245 Million Rust Downloads at Risk

for 86 minutes on august 20, if your rust project resolved the poisoned arrayref release and you compiled it, you might have installed an infostealer without touching a single line of malicious code. you did not run it. you did not call it. you just built your project, like you do every day, and that was enough.

here is what happened. someone compromised the crates.io account of david roundy, a rust maintainer in good standing since 2009, and the owner of arrayref, internment, and append-only-vec. this is not some abandoned package with three users. these are trusted, load-bearing libraries maintained by a known name, and that account became the key to the whole registry's trust.

the attacker republished all three crates. the code inside looked clean, because it was clean. the trick was one added line. each poisoned crate now depended on proc-macro1, a fake package typosquatting the real proc-macro2, right down to forging the name of proc-macro2's actual author in its metadata. the malicious part lived in that dependency's build script, the code that runs automatically when you compile.

that is the whole nightmare in one detail. the payload ran at build time. you did not have to use the library, call a function, or ship anything. compiling was the trigger. the build script quietly rebuilt its command server address from base64, pulled down a second-stage binary over a connection that skipped certificate checks, and ran it. then it went looking for credentials, querying the sqlite files behind chrome, brave, and edge and enumerating saved login and browser-extension data.

now understand the scale, because this is the part that should stop you. arrayref is a tiny four-macro utility with more than 245 million downloads and more than 400 dependent crates. it sits in more than a third of all software environments, and in roughly three out of four environments where rust is present. nobody chooses arrayref. it rides in underneath the libraries you actually picked, the graphics stacks, the cryptography, big parts of the solana and ethereum tooling. it is load-bearing infrastructure nobody thinks about, which is exactly why it is the perfect target.

and there is one more detail worth noticing. proc-macro1 was reportedly the first dependency added to arrayref in roughly a decade. a tiny, stable crate that had barely changed its dependency model suddenly gained a new dependency, and that dependency was the trap.

and this was not a smash-and-grab. the attacker yanked legitimate older versions to quietly steer new builds toward the poisoned one. they staged throwaway test crates days earlier. that is not a bored teenager. that is operational discipline, and researchers at wiz found significant infrastructure overlap with earlier north korean supply-chain campaigns, including the dprk-linked mastra and axios operations. that is not definitive attribution of this specific incident to north korea, but it is a state-linked playbook, and it is registry-agnostic. the same technique has now hit npm, pypi, and crates.io. the language does not matter. the trust model does.

the response was actually fast. the rust security team pulled everything within about two hours. arrayref itself was removed after 86 minutes, while internment remained live for about 90 minutes and append-only-vec for about 107. by supply-chain standards that is excellent. but two hours is not zero. every ci pipeline that ran a fresh build in that window, every overnight job that resolved a new dependency tree, could have run the payload without one alarm going off. speed of response does not help the builds that already happened.

the lesson is not to fear rust. rust is not the problem, and neither is any single registry. the problem is the model every modern ecosystem runs on. you do not install software anymore. you install a tree, hundreds of packages deep, maintained by hundreds of strangers, and you trust every one of them by default. most of the time that trust is fine. it only takes one compromised account, at one load-bearing crate, for one afternoon.

you were never really trusting arrayref. you were trusting that nobody would ever take over the account behind it. on august 20, for 86 minutes, someone did.

Similar topics

NovaCookies Phishing Kit Steals Microsoft 365 Sessions to Bypass MFA

NovaCookies Phishing Kit Steals Microsoft 365 Sessions to Bypass MFA

For US$320 a month, NovaCookies rents anyone the ability to walk past your MFA. It does not steal your password. It steals your session, the proof you already logged in, after you authenticate perfectly. MFA did not fail. It just stopped being the finish line.
Microsoft Patched 400 Bugs This Month and That Is Not the Scary Part

Microsoft Patched 400 Bugs This Month and That Is Not the Scary Part

Microsoft patched over 400 flaws in a single month, triple the normal load, because AI now hunts bugs faster than any human team. But real-world exploitation has not surged to match. The scary number is not 400. It is 13 of 14, and the gap is closing fast.
Berlin Won't Pay VICE SPIDER and Here Is Why It Changes Nothing

Berlin Won't Pay VICE SPIDER and Here Is Why It Changes Nothing

Berlin refused to pay the ransomware crew that breached its network. Good. But the data was already gone a week before anyone pulled the plug. Refusing to pay is the honorable call, and it does not save you. The failure that mattered happened quietly, days earlier.
The Ransomware Group Nobody Should Be Worried About Yet

The Ransomware Group Nobody Should Be Worried About Yet

TITAN says its AI reads 700GB of stolen data an hour. The number is unverified marketing, and the group is a nobody: 24 victims in four months against leaders posting 100 a month. The real AI-in-ransomware story is quieter, and it is not TITAN.
SKO Hype, Hollow Leadership, and the Power of Real Connections

SKO Hype, Hollow Leadership, and the Power of Real Connections

SKO is a spectacle of forced enthusiasm, hollow leadership, and empty theatrics, wrapped in corporate excess. True value lies not in scripted speeches but in the rare, genuine connections between colleagues. The show fades, the noise quiets, but real bonds endure long after the lights dim.