Full Report
The Rust Project has deleted malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account published releases that added a typosquatted dependency whose build script downloaded and executed a remote payload during compilation. The affected releases are arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, all published from the same owner
Analysis Summary
# Incident Report: Rust Supply Chain Compromise via Typosquatted Dependency
## Executive Summary
On August 20, 2026, a compromised maintainer account published malicious versions of three widely used Rust crates (`arrayref`, `internment`, and `append-only-vec`). The attacker injected a typosquatted dependency, `proc-macro1`, which executed a multi-platform remote payload during the build process. The Rust Security Response Team intervened within approximately two hours, removing the malicious crates and mitigating further spread.
## Incident Details
- **Discovery Date:** August 20, 2026
- **Incident Date:** August 20, 2026
- **Affected Organization:** The Rust Project (crates.io)
- **Sector:** Software Development / Open Source Supply Chain
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** 2026-08-20T07:15:00Z
- **Vector:** Compromised Maintainer Account (User 2402)
- **Details:** The attacker gained access to a trusted maintainer's account and published `[email protected]`.
### Lateral Movement
- **Details:** Not applicable in the traditional network sense; the attacker used the initial account access to publish malicious updates across multiple high-traffic crates managed by the same owner.
### Data Exfiltration/Impact
- **Impact:** The malicious `proc-macro1` dependency executed a build-time payload. On Unix/macOS, it spawned a detached process via `/tmp/rust-setup`. On Windows, it executed a hidden PowerShell script via VBScript to bypass Cargo’s job management.
### Detection & Response
- **07:15 UTC:** Nextron Systems GmbH Research Team discovered and reported the malicious `proc-macro1` crate.
- **08:41 – 09:25 UTC:** The Rust Security Response Team deleted the malicious versions of all three crates.
- **Post-Incident:** The team "un-yanked" previous safe versions (0.3.5–0.3.9) to ensure developers did not default to the malicious release.
## Attack Methodology
- **Initial Access:** Account Takeover (ATO) of a crate maintainer.
- **Persistence:** Not explicitly maintained; relied on the "window of opportunity" while malicious crates were live.
- **Defense Evasion:**
- Used a typosquatted name (`proc-macro1` vs the legitimate `proc-macro2`).
- Library source was a clone of the real crate to ensure builds finished without errors.
- Disabled TLS validation via a custom certificate verifier.
- Escaped Cargo's process tracking on Windows using `wscript.exe`.
- **Discovery:** The attacker "yanked" (deprecated) previous versions of the crates to force the Cargo package manager to suggest the malicious version to users.
- **Impact:** Remote Code Execution (RCE) during the compilation phase.
## Impact Assessment
- **Financial:** Unknown; potential costs associated with incident response and audit for affected downstream companies.
- **Data Breach:** No evidence of data theft reported, though the payload established C2 connectivity.
- **Operational:** High potential; affected crates have a combined download count of ~245 million.
- **Reputational:** Significant; highlights vulnerabilities in the Rust ecosystem's account security and supply chain.
## Indicators of Compromise
- **File Indicators:**
- `/tmp/rust-setup` (Unix/macOS)
- `%TEMP%\[random].ps1` (Windows)
- `proc-macro1` (Typosquatted crate name)
- **Behavioral Indicators:**
- Crate builds attempting to connect to external IPs via `wscript.exe` or PowerShell.
- Unusually fast "yanking" of multiple previous crate versions.
- **Network Indicators:**
- C2 communications (Base64 encoded in the `build.rs` script of `proc-macro1`).
## Response Actions
- **Containment:** Malicious crates deleted from crates.io within 86-107 minutes of publication.
- **Eradication:** Typosquatted crates (`proc-macro1`, `proc-macro-en`, etc.) removed from the registry.
- **Recovery:** Safe versions of `arrayref` were un-yanked to restore the legitimate supply chain.
## Lessons Learned
- **Credential Security:** Critical maintainers of high-download crates are high-value targets; lack of MFA or account session monitoring can lead to massive supply chain exposure.
- **Dependency Trust:** The "typosquatting" of a core library (`proc-macro2`) within a legitimate crate's manifest is an effective way to hide malware from casual inspection.
- **Registry Mechanics:** The ability for an attacker to "yank" all previous versions and force a "lure" warning in the CLI is a powerful social engineering vector.
## Recommendations
- **For Maintainers:** Enable Mandatory Two-Factor Authentication (2FA) for all crates.io accounts.
- **For Developers:**
- Use `cargo-deny` or similar tools to audit new dependencies.
- Inspect `~/.cargo/registry/cache` for any traces of the deleted versions.
- Pin critical dependencies to specific, audited versions rather than allowing "latest."
- **For the Rust Project:** Implement automated alerts for when a maintainer yanks multiple versions of a high-traffic crate in a short timeframe.