LinkedIn·Thursday, 20 August 2026·6d ago
‼️ Two popular Rust crates, arrayref and append-only-vec, were compromised in a supply chain attack. arrayref alone has 244M downloads. The…
Aikido Security
41,357 followers
‼️ Two popular Rust crates, arrayref and append-only-vec, were compromised in a supply chain attack. arrayref alone has 244M downloads. The malware ran at build time, which means anyone who compiled a project that pulled one in was hit, without ever calling the crate.
Each crate had a single line added to its manifest: a dependency on proc-macro1, a typosquat of proc-macro2. proc-macro1 ships the real proc-macro2 code, so everything built and worked normally. Nothing looked off.
The malicious part was in proc-macro1's build script, which Cargo runs automatically. During the build it downloaded a binary from a bare-IP server and ran it silently in the background, with a version for Linux, macOS, and Windows.
Both crates came from the same maintainer, so their publish credentials were likely stolen. crates.io has since removed the bad versions. Check your lockfiles for arrayref 0.3.10, append-only-vec 0.1.9, or any dependency on proc-macro1.
Ilyas broke it down here: https://lnkd.in/dsKHJsz2
♥ 66↻ 14
View on LinkedIn Cross-referenced
Related on the wire
npm shipped Trusted Publishing in late 2025. It's free and takes about ten minutes to set up (not to mention, it also blocks an entire…
🌶️🌶️🌶️
Introducing Android Pentests 🚀 Autonomous AI agents log into your app and test it the way an attacker would. One assessment covers the…
We're #hiring a new AI Engineer (Infrastructure Pentest) in Ghent, Flemish Region. Apply today or share this post with your network.
Aikido Security achieves ISO 42001:2023 certification, the international standard for AI governance. 🌟 Independently audited AI governance…
Earlier this year, someone’s OpenClaw agent reportedly hacked a gym's booking system in Australia, just from being asked to help book a…