Rust Supply Chain Attack Distributes Build-Time Malware via Compromised Crates.io Accounts

In August 2026, malicious versions of three widely used Rust crates were discovered and subsequently removed from crates.io. The affected packages are arrayref version 0.3.10, internment version 0.8.7, and append-only-vec version 0.1.9. According to reports, all three malicious releases were published from the same owner account, which appears to have been compromised by threat actors.

The attack mechanism involved the addition of a typosquatted dependency. The build script associated with this dependency executed during compilation, downloading and executing a remote payload. This represents a build-time supply chain attack, where malicious code is injected during the software construction phase rather than in the final distributed binary, although the impact extends to all downstream consumers.

The potential impact is significant, with reported figures indicating approximately 245 million total downloads across the affected crates. Security researchers and the Rust community are urging developers to audit their dependencies and update to clean, verified versions of the packages immediately. The exact origin of the threat actors, the specific nature of the remote payload, and the full extent of compromised systems remain under investigation and are currently unconfirmed.