Rust Crate Tampering: Multi-Stage Info-Stealer Malware Launched via build.rs

1. Basic Information Article Title : ArrayRef Rust Crate Supply Chain Attack Publisher : StepSecurity Publication Date : 2026-08-20 Severity : Critical Original Source : StepSecurity Related Source : Hackers poison ArrayRef Rust crate to push infostealer malware Related Malware : proc-macro1 dropper, proc-macro-en dropper Threat Actor : None / Unidentified CVE : None Products & Technologies : arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9, Cargo, crates.io 2. Executive Summary A supply chain attack that adds malicious dependencies to legitimate crates from compromised developer accounts, launching information-stealing malware during the build process without needing to execute the target code. Reason for Severity: Widely used legitimate crates and related crates were tampered with in quick succession. Execution happens simply by Cargo resolving dependencies and building. Developer machines and CI/CD credentials are the targets. 3. Attack Flow Infection During Cargo Build The attacker compromises crate administrator accounts and publishes malicious versions of arrayref, internment, and append-only-vec. While keeping the legitimate code, they add dependencies on typosquatted proc-macro1/proc-macro-en and include a build.rs script. When a developer or CI resolves new dependencies, updates them, and builds, build.rs runs automatically. There is no need to call functions in the target crate. build.rs disables TLS certificate verification to download the next stage and runs it from a temporary folder. On Linux, it establishes persistence in user settings and systemd. On Windows, it runs temporary PowerShell/VBS scripts. The next stage collects credentials from browsers and development environments, then sends them to the attacker. Luring Users to Malicious Versions For arrayref, the clean version was yanked, and dependency resolution was manipulated to pull the malicious version. Due to deleted versions, local caches, and vendoring states, it is hard to judge sa