Compromised Rust packages executed malware during project builds, researchers report

A compromised release of the widely used Rust crate `arrayref` introduced a dependency that downloaded and executed malware while affected projects compiled, according to an analysis by software supply-chain security company SafeDep. The malicious package versions were subsequently removed from crates.io.

Version 0.3.10 of `arrayref` added `proc-macro1`, a typosquatted name resembling the legitimate `proc-macro2` package. The malicious dependency copied genuine `proc-macro2` source so normal builds could continue, but added a build script in version 1.0.107. Cargo builds declared non-optional dependencies even when application code does not call them, making the manifest change sufficient to run the script.

SafeDep said the genuine maintainer account for `arrayref` and `append-only-vec` appeared to have been compromised. A separate publisher account named `dtolney`, close to legitimate maintainer David Tolnay's `dtolnay` name, uploaded `proc-macro1` with forged author metadata and a repository link that did not exist.

The build script reconstructed server addresses from base64 fragments, selected a binary for the host operating system and architecture, and downloaded it through a TLS connection configured to accept any certificate. On Unix it wrote an executable to `/tmp/rust-setup` and launched it without waiting. On Windows it created a PowerShell file and hidden VBScript launcher in the temporary directory, detaching execution so Cargo could finish normally.

Older clean `arrayref` releases from 0.3.5 through 0.3.9 had been yanked. That action could prompt Cargo users to update toward 0.3.10, which was then the only non-yanked version, according to the RustSec reporter cited in the analysis.

The crate's reach made the incident significant, but download totals do not reveal the number of compromised systems. SafeDep counted about 245 million lifetime `arrayref` downloads, including roughly 152 million for clean version 0.3.9. The package appears transitively in Rust graphical software through dependencies including `tiny-skia`, `sctk-adwaita` and `winit`.

Indicators listed by the researchers include connections to `23.254.165.112` on ports 9089 and 443, `/tmp/rust-setup` on Unix, and `rust-setup.ps1` plus `rust-setup-launch.vbs` under the Windows temporary directory.

The report distinguishes exposure from confirmed infection: simply compiling a graph that selected the malicious versions could trigger the first-stage code, but aggregate download statistics cannot show where that happened. Developers assessing risk need to inspect resolved dependency versions, build records, network activity and the listed files rather than infer compromise from ecosystem-wide counts alone.

Because the harmful behavior lived in a dependency build script, reviewing only the visible `arrayref` macro implementation would not have exposed the execution path. The incident highlights the authority build tooling grants to transitive packages before an application ever runs. The removal of the listed versions prevents new resolution from crates.io, but it does not by itself assess machines that compiled them while they were available.