The Rust Security Response Team confirmed that a compromised maintainer account was used to publish malicious versions of three widely used crates, arrayref, append-only-vec, and internment, to the crates.io registry on August 20. Each poisoned release added a single new dependency, proc-macro1, a typosquat of developer David Tolnay’s legitimate proc-macro2 package published only four minutes earlier under an account impersonating him. The team’s own advisory is blunt about the mechanism: “the crate had a build script that was downloading a malicious payload,” meaning the code ran automatically the moment a developer’s machine compiled anything that resolved the dependency, with no need to import or call it. Arrayref alone accounts for more than 245 million all-time downloads. The team caught the report at 07:15 UTC and pulled the malicious version by 08:41, an 86-minute exposure window.
Why it matters to security leaders is the delivery mechanism, not the payload. Build scripts run with the full privileges of whatever machine is compiling code, meaning a CI runner, a developer laptop, or a build server all execute the same untrusted script with no sandbox by default, the same blind spot this publication documented in the LiteLLM and Trivy scanner compromise earlier this month.
The original insight is in the timing discipline the ecosystem showed compared to past incidents like the self-propagating ChainDrop npm worm: a static, one-time typosquat with no propagation logic was caught and removed in under an hour and a half, evidence that faster maintainer-account monitoring is starting to close the window that self-replicating attacks like ChainDrop were built to exploit. Security teams should still audit whether arrayref, append-only-vec, or internment were pulled locally during that window by checking the Cargo registry cache, since a removed package from the registry does not remove it from a machine that already downloaded it.
Source: The Rust Blog
