A malicious supply chain attack against the Rust ecosystem was identified on August 20, 2026, with researchers linking the operation to North Korean state-sponsored actors. Compromised versions of three widely used crates—arrayref 0.3.10, append-only-vec 0.1.9, and internment 0.8.7—were published to crates.io and remained available for between 86 and 107 minutes before the Rust Security Response Team removed them.
According to technical analysis from Aikido, the attackers gained access through compromised maintainer credentials or a developer machine. The tampered packages introduced a dependency on a malicious crate named proc-macro1, and a build script executed code during software compilation. The payload was designed to steal browser credentials and access local storage associated with cryptocurrency wallet extensions.
The Wiz Threat Intelligence team found infrastructure overlaps with previous cyber-espionage campaigns attributed to Pyongyang. Command-and-control servers used IP ranges from Hostwinds LLC that had appeared in earlier reports by Google Cloud Threat Intelligence and Mandiant tied to the advanced persistent threat group UNC1069. This actor has previously targeted open-source ecosystems such as npm, and the incident suggests an expansion toward low-level Rust dependencies to hit digital-asset companies and developer environments.
The Rust Security Response Team revoked the compromised packages and temporarily locked the affected maintainer's account. Security teams are now auditing Cargo.lock files for dependencies on proc-macro1, proc-macro-en, or unauthenticated versions.
Because crates such as arrayref are used across roughly three-quarters of Rust environments—and are deeply integrated into the Solana ecosystem—the attack has drawn particular concern from developers and security commentators including @SlowMist_Team. arrayref alone accounts for more than 244 million cumulative downloads. The incident underscores the need for stricter supply-chain security around Solana infrastructure and the broader Rust toolchain.
