Compromised Rust crate arrayref 0.3.10 pulls typosquat proc-macro1, whose build script downloads and runs a remote binary

Linha do tempo

1. safedep.io ↗ · pub. 19/08/2026 21:00 · coletado 19/10 18:03 primeiro registro

   Compromised Rust crate arrayref 0.3.10 pulls typosquat proc-macro1, whose build script downloads and runs a remote binary

   ler a análise desta fonte ocultar

   On August 20, 2026, a compromised release of the Rust crate arrayref (0.3.10, about 245 million all-time downloads) appeared on crates.io. It added a dependency on the typosquatted crate proc-macro1 1.0.107, whose build script downloads and runs a remote binary at compile time. The maintainer account droundy appears to have been compromised, and the related GitHub repositories and account now return 404. The crates.io team has removed the malicious versions. append-only-vec is also named as a genuine crate maintained by the same account.

   Technical Details

   • proc-macro1 was published by the account dtolney, which imitates David Tolnay's dtolnay account. Its metadata forges the author and points to a non-existent dtolnay/proc-macro1 repository. Its src/ is a find-and-replace copy of the genuine proc-macro2, so builds keep working.
   • The arrayref 0.3.10 manifest adds [dependencies.proc-macro1] version = "1.0.107". Cargo builds all declared dependencies, so the malicious build script runs even though arrayref's source never references it.
   • The build script adds build-dependencies not found in proc-macro2: base64, rustls and ureq. The server address is stored as base64 fragments and reassembled at build time. It decodes to the payload host hxxps://23[.]254[.]165[.]112:9089/ and the C2 address 23[.]254[.]165[.]112:443.
   • The download uses a custom AcceptAll TLS verifier that accepts any certificate. The binary is selected by OS and architecture (linux/windows/macos x86_64, macos aarch64), and the build panics on other platforms. There is no feature or environment gate.
   • On Unix the payload is written to /tmp/rust-setup, made executable with chmod and spawned detached with the C2 address as its first argument and all standard streams sent to null.
   • On Windows the fetched bytes are a PowerShell script written to %TEMP%\rust-setup.ps1. A VBScript launcher run via wscript.exe starts it hidden with ExecutionPolicy Bypass. This escapes Cargo's job object, and std::mem::forget leaks the child handle so the build does not wait.
   • The owner account yanked arrayref 0.3.5 through 0.3.9. Cargo's yanked-version warning then nudges developers toward the malicious 0.3.10, and the RustSec reporter hit it this way.
   • arrayref is a deep transitive dependency via tiny-skia, sctk-adwaita and winit, which puts it under much GUI work built on egui, eframe and iced. The download count measures usage, not the number of affected builds.

   Remediation

   • Check lockfiles and build logs for arrayref 0.3.10 and proc-macro1 1.0.107, and pin or revert to arrayref 0.3.9.
   • Hunt on build hosts and CI runners for /tmp/rust-setup, %TEMP%\rust-setup.ps1, the VBS launcher, and connections to 23.254.165.112 on ports 9089 and 443.
   • Treat any host that compiled an affected version as potentially compromised, and rotate credentials and secrets available to the build environment.
   • Review dependency changes before updating, especially new build-time dependencies and look-alike crate names.