Affected Systems

Three Rust crates (arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9) with 245 million combined downloads. Malicious versions were live for 86-107 minutes on August 20, 2026. Developers who built projects resolving these versions during that window executed remote payloads. Transitive dependencies include winit (via sctk-adwaita → tiny-skia → arrayref) and formerly blake3, blake2b_simd, blake2s_simd.

Exploitation Status

Active supply chain attack. Malicious versions published August 20, 2026, and removed within 86-107 minutes. No confirmed evidence of actual usage per RustSec advisories, but attack was functional. Stage-2 implant steals browser credentials (Chrome, Brave, Edge) and establishes persistence via Registry Run keys (Windows), LaunchAgents (macOS), and systemd user services (Linux). Discovered and reported by Nextron Systems Research Team.

Business Impact

Developers who ran cargo build during the 86-107 minute window on projects depending on affected crates executed arbitrary code. The malicious build script disabled TLS validation, downloaded OS-specific payloads to /tmp/rust-setup (Unix/macOS) or %TEMP% (Windows), and executed them with C2 address. Stage-2 implant persists on developer workstations, exfiltrates browser credentials, and accepts remote commands. Compromised maintainer account (user 2402, David Roundy) suggests credential or endpoint compromise. No CVE assigned. RustSec advisories RUSTSEC-2026-0260 (arrayref) published. Attack vector was yanking safe versions (0.3.5-0.3.9) to lure users to malicious 0.3.10 via cargo warnings.

Urgency

🔴 Immediate

Recommended Actions

  • Audit ~/.cargo/registry/cache (Linux/macOS) and %USERPROFILE%\.cargo\registry\cache (Windows) for arrayref-0.3.10.crate, internment-0.8.7.crate, append-only-vec-0.1.9.crate, and proc-macro1 crate files; delete if found
  • Search developer workstations for persistence mechanisms: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\rust-setup (Windows), ~/Library/LaunchAgents/com.rust.setup.plist (macOS), ~/.config/systemd/user/rust-setup.service (Linux)
  • Hunt for /tmp/rust-setup (Unix/macOS) and PowerShell/VBScript launchers in %TEMP% (Windows); check process history for wscript.exe spawning hidden PowerShell during cargo builds on August 20, 2026
  • Pin arrayref to 0.3.9 or earlier in Cargo.toml; verify Cargo.lock does not reference 0.3.10, 0.8.7, or 0.1.9 of affected crates; run cargo update to resolve to safe versions
  • Rotate credentials for any developer who built Rust projects on August 20, 2026 between 07:15-09:25 UTC; inspect browser credential stores (Chrome/Brave/Edge SQLite databases) for unauthorized access; review outbound HTTPS POST to path /49890878 in proxy logs