Hackers compromised several popular Rust software packages ("crates") this week in a supply chain attack designed to steal developers' credentials, turning routine software builds into a delivery mechanism for infostealer malware. The Rust Security Response Team disclosed the incident after being tipped off about a malicious package called proc-macro1, and found that attackers had also published a poisoned version of arrayref, a widely used legitimate crate, likely after compromising its maintainer's account rather than the maintainer acting maliciously. The attack matters because it shows how easily trusted software supply chains can be exploited to reach developers' machines directly.

The malicious arrayref release was live for 86 minutes, with related poisoned packages internment and append-only-vec available for 90 and 107 minutes respectively before removal; arrayref alone has roughly 245 million lifetime downloads, according to security firm Aikido. The malware, hidden in a build script, detected the victim's operating system and chip architecture before downloading and running a payload targeting Chromium-based browsers and cryptocurrency wallet data, with versions built for Linux, Windows and Mac systems. The Rust team has also removed several other malicious crates and urged developers to check their lockfiles and caches, though it has not disclosed how many systems were affected or how the original compromise occurred.