Overview
- Security researchers reported a malicious proc-macro crate whose build script downloaded and ran a remote payload during cargo build, and the Rust team verified the behavior before removing the crate and related packages from crates.io.
- The team deleted attacker-controlled crates including proc-macro1, proc-macro-en, aovine, arone, aronenao, and tinymember and removed specific malicious releases such as arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9.
- The popular arrayref crate was republished to depend on the typosquatted proc-macro1, the Rust team restored previously yanked safe releases, locked the affected author account as a precaution, and said the maintainer’s credentials or machine were likely compromised.
- The Rust blog published step-by-step guidance and a filesystem find command to help developers locate and remove any cached malicious crates from their local Cargo registries and recommended treating any build hosts that compiled affected code as potentially compromised.
- Independent analysis found the payload installs a persistent backdoor that steals browser credentials, beacons to command-and-control hosts, and reuses techniques seen in other campaigns, increasing the risk to developer workstations and CI systems and prompting calls to rotate exposed secrets and rebuild artifacts from clean sources.