Backdoored Rust Crates Delivered Infostealer at Build Time

Three Rust crates with a combined 245 million downloads were backdoored and briefly served through crates.io after attackers compromised a shared maintainer account, The Hacker News reports. The Rust Project has removed the malicious releases. If your build pipeline pulled any of the affected versions, treat the build host as compromised until credential rotation is complete.

Confirmed affected releases

• arrayref 0.3.10
• internment 0.8.7
• append-only-vec 0.1.9

All three published from the same owner account. Run cargo update and verify your Cargo.lock no longer pins any of these version strings. Clean releases remain available on the registry.

Attack mechanism

Each malicious release introduced a typosquatted dependency. That dependency’s build.rs script fetched and executed a remote payload during compilation — meaning the malware ran on any machine that ran cargo build or cargo install while the poisoned versions were live. BleepingComputer reports the payload is an infostealer. CI/CD pipelines, developer laptops, and build containers that compiled code depending on these crates during the exposure window were all in scope.

No CVE has been assigned as of publication. Attribution is unconfirmed.

Immediate actions

Any environment that pulled the poisoned versions during the exposure window should be treated as an untrusted host. Priority credential rotation targets: cloud provider keys, package registry tokens (crates.io, npm, PyPI, and any private registries accessible from the build host), CI/CD secrets, and SSH keys present on affected machines.

Check Cargo.lock for the version strings above. If your supply chain tooling doesn’t flag build-script network access, this is a gap worth closing — Rust’s build.rs execution has no default sandbox, and this attack class is not new.

Prior context

Package registry compromises via account takeover continue across ecosystems. Related coverage: 16 Fake RubyGems Stealing Browser Creds and Crypto Wallets, Trivy, Not LiteLLM, Drove the March Supply Chain Breach, and Arch Linux AUR Lockdown After Malware Takeover Surge.