Rust crate arrayref with 245M downloads hit in supply chain attack

A sophisticated supply chain attack targeted the widely used Rust programming language ecosystem on August 20, 2026, when compromised maintainer accounts were used to publish malicious versions of several popular software libraries. The incident exposed developer systems to information-stealing malware that executed automatically during the software build process, raising significant concerns about the security of open-source dependency management.

The attack began when the legitimate account for user "droundy," which maintains the popular arrayref crate, was compromised. Starting at 01:17 UTC, the attacker also created a separate account impersonating prominent Rust developer David Tolnay to publish a malicious package named procmacro1. Using the compromised "droundy" account, the attacker then published tainted versions of three crates: arrayref 0.3.10, appendonlyvec 0.1.9, and internment 0.8.7. These releases kept the original library code intact but added a dependency on the malicious procmacro1 crate.

The malicious code was not in the libraries themselves but in the build script of the injected dependency. When a developer or automated system built a project that resolved...