Attackers poisoned three Rust crates to steal developer credentials during builds

Why it matters

Rust build scripts execute with developer privileges during compilation, giving a poisoned dependency access to the credentials, source code, and signing keys used to ship software.

Attackers used the legitimate crates.io publisher account of David Roundy on August 20th to ship malware through three widely downloaded Rust packages, turning an ordinary software build into code execution on developer workstations and CI systems.

The affected releases were arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, according to the Rust Security Response Team. Rust administrators removed the releases and locked Roundy's account after concluding that his computer or credentials were likely compromised. They said they did not believe Roundy acted maliciously.

Roundy is a physicist and longtime open-source developer who originally developed the Darcs version-control system. His academic CV lists a physics doctorate from the University of California, Berkeley, followed by research positions at MIT and Cornell and a faculty appointment at Oregon State University. The attack exploited the trust accumulated around software he had maintained for years, rather than introducing a disposable package and waiting for developers to find it.

BleepingComputer reported that the three poisoned releases appeared within 23 minutes. Each added a dependency on proc-macro1, an attacker-controlled imitation of the legitimate proc-macro2 project associated with prominent Rust maintainer David Tolnay. Tolnay was impersonated through lookalike package metadata and an account named dtolney; the reporting provides no indication that his real account was compromised.

One dependency line carried the attack

The ordinary source code inside Roundy's crates remained essentially unchanged. The malicious addition was a dependency declaration pointing to proc-macro1 1.0.107, according to analyses from StepSecurity, SafeDep, and Aikido.

Cargo automatically built the declared dependency, even though the affected libraries did not call it. The build.rs file inside proc-macro1 then reconstructed a server address from Base64 fragments, disabled certificate verification, selected a payload for the host's operating system and processor architecture, and downloaded it during compilation.

The dropper supported Linux x86-64, Windows x86-64, macOS x86-64, and macOS ARM64. On Unix systems it wrote an executable to /tmp/rust-setup and launched it as a detached process. On Windows it created a PowerShell file in the temporary directory and used a hidden VBS launcher under wscript.exe. The build could still finish successfully, leaving the developer with normal compiler output while the payload continued running.

Wiz researchers analyzed the second-stage implant and found credential theft, persistence, and remote-command functions. Wiz said the malware queried Chrome, Brave, and Edge login databases, transmitted host information and stolen credentials, and installed persistence through a Windows Registry Run key, a macOS LaunchAgent, or a Linux systemd user service. It could also download and execute additional shell or PowerShell scripts.

The attacker manufactured an upgrade path

The operation began hours before Roundy's packages were touched. At 01:17 UTC, the attacker created the lookalike dtolney GitHub account. A matching crates.io identity followed minutes later. At 01:55, that account published proc-macro1 1.0.106 as an apparently clean copy of proc-macro2, giving the package several hours of publishing history before version 1.0.107 added the malicious build script at 07:11.

Four minutes later, Roundy's account published arrayref 0.3.10. The account then yanked versions 0.3.5 through 0.3.9 in rapid succession. Existing lockfiles could continue using a yanked release, but Cargo would warn developers to update. A developer following that warning could resolve the newly published 0.3.10 release, which was the poisoned version.

The same account published internment 0.8.7 at 07:34 and append-only-vec 0.1.9 at 07:37. A public RustSec report followed at 07:54. Registry administrators deleted arrayref 0.3.10 after 86 minutes, internment 0.8.7 after 90 minutes, and append-only-vec 0.1.9 after 107 minutes. They also deleted the attacker-controlled packages proc-macro1, proc-macro-en, aovine, arone, aronenao, and tinymember.

StepSecurity estimated that the three legitimate packages had roughly 264 million combined lifetime downloads. arrayref accounted for about 245 million of those and 53.7 million downloads during the preceding 90 days. Those registry totals count downloads, rather than unique developers, installations, or confirmed infections. The narrower exposure population consists of machines that resolved and built one of the malicious versions while it was available.

The dependency reach remains substantial. StepSecurity identified 406 crate versions depending directly on arrayref, including paths into the blake3 hashing library, Rust GUI projects such as egui, eframe, and iced, and components used in Ethereum and Solana software. A pre-existing lockfile pinned to a clean release would generally avoid the poisoned update. New or refreshed lockfiles during the exposure window carried the greater risk.

Developer machines became the target

Wiz said the command-and-control infrastructure overlapped with infrastructure and techniques seen in supply-chain operations attributed to North Korean actors, including previously reported Mastra and axios compromises. The overlap includes hosting ranges, beacon paths, certificates, and an address reported in another campaign. That evidence establishes a technical connection between operations; it does not independently identify who controlled Roundy's account.

The attack concentrated on the machines that compile software because those systems often hold source code, browser sessions, cloud credentials, CI tokens, signing keys, and package-publishing access. The implant did not need the final application to run. Cargo executed it while preparing a dependency, before the affected library's functionality entered the picture.

The Rust Security Response Team advised developers to inspect Cargo caches and lockfiles for the deleted versions and attacker-controlled package names. Wiz and StepSecurity also recommended checking for connections to 23.254.165.112 on ports 9089 and 443 and for files including /tmp/rust-setup, rust-setup.ps1, and rust-setup-launch.vbs.

Any workstation or CI runner that built an affected dependency during the relevant window should be treated as compromised. Remediation includes rotating every credential accessible from the machine, revoking browser sessions and CI tokens, replacing signing and publishing keys, and rebuilding affected environments and artifacts from known-clean sources.