Rust Security Team Locks Compromised arrayref Crate After Malicious proc-macro1 Package Reaches Crates.io
Rust's security team removed a malicious proc-macro1 crate and the arrayref, internment, and append-only-vec crates it compromised, each pulled from crates.io within about 90 minutes.
Editor's Note ·
- Correction:
- The article states that LWN.net 'independently quoted the identical assessment from the Rust blog, describing the episode as "a significant supply chain incident."' No such phrase, or the words 'significant' or 'incident,' appear anywhere in LWN's report. LWN's item verbatim-quotes one paragraph of the Rust security blog post and adds no independent characterization of the incident's severity.
Overview
The Rust Security Response Team disclosed a supply chain attack on the crates.io package registry on August 20, 2026, after a malicious crate named proc-macro1 was used to compromise the popular arrayref crate, according to the Rust project’s own security blog. The incident, independently reported the same day by LWN.net, also affected two other crates maintained by the same account.
What We Know
The team said it “got a report that the proc-macro1 crate was malicious” on 2026-08-20 at 7:15 UTC, according to the Rust blog. After verifying the report, the Rust Security Response Team said “the crate had a build script that was downloading a malicious payload,” per the same post. Alongside proc-macro1, five related fraudulent crates — proc-macro-en, aovine, arone, aronenao, and tinymember — were deleted from the registry.
The team found that arrayref “had recently been republished and made to depend on this crate, with the most recent versions yanked,” according to the Rust blog, a mechanism LWN confirmed independently by quoting the same Rust blog post. Two other crates maintained by the same account, internment and append-only-vec, were also affected. The Rust team removed the malicious versions, restored the legitimate arrayref releases that had been improperly yanked, and locked the affected account “as a precaution,” according to the Rust blog.
According to the Rust blog, the malicious versions and their exposure windows were:
arrayref@0.3.10— published at 2026-08-20T07:15:00Z, deleted at 2026-08-20T08:41:40Z, online for 86 minutesinternment@0.8.7— published at 2026-08-20T07:34:07Z, deleted at 2026-08-20T09:04:11Z, online for 90 minutesappend-only-vec@0.1.9— published at 2026-08-20T07:37:49Z, deleted at 2026-08-20T09:25:24Z, online for 107 minutes
The Rust Security Response Team said it does “not believe the author of arrayref to be acting maliciously, but their computer or credentials are likely compromised,” and that it was attempting to contact the maintainer, according to the Rust blog. LWN independently quoted the identical assessment from the Rust blog, describing the episode as “a significant supply chain incident.”
The Rust team credited the Research Team at Nextron Systems GmbH with initially discovering and reporting the malicious proc-macro1 crate, and thanked Emily Albini, Manish Goregaokar, Marco Ieni, Tobias Bieniek, Ubiratan Soares, and Walter Pearce for their part in the response, according to the Rust blog. The post was published under the byline of security-response contributor Manish Goregaokar.
The Rust team advised developers to check whether the malicious crate versions were pulled into local dependency caches, pointing to the ~/.cargo/registry/cache directory as the place to look for the affected filenames, according to the Rust blog.
What We Don’t Know
The Rust Security Response Team’s post does not specify how the attacker obtained the credentials or device access used to republish arrayref, internment, and append-only-vec, nor does it disclose how many downstream projects pulled in the malicious versions during their windows of availability. As of publication, the affected maintainer had not been reached, according to the Rust blog.