A threat actor compromised the crates.io account of a legitimate maintainer and injected a malicious proc-macro1 dependency into new releases of popular Rust crates (arrayref, internment, and append-only-vec). When developers or CI/CD pipelines run standard cargo build commands, the malicious build.rs script automatically fetches and executes cross-platform stage-2 malware (supporting Linux, macOS, and Windows). The backdoor inventories system info, harvests Chromium browser credentials, establishes user-level persistence (Windows HKCU Run keys, Linux systemd user services, macOS LaunchAgents), and executes remote C2 commands.
criticalSupply chain·
AGS-2026-0012
Popular Rust Crates Compromised in Build-Time Supply Chain Attack
Affected
- namePattern
- arrayref
- versionRange
- 0.3.10
- namePattern
- internment
- versionRange
- 0.8.7
- namePattern
- append-only-vec
- versionRange
- 0.1.9
- sha256
- cb7778eb6dda91028abf087eb7c3553f981a67e756769507d348e8c201805568
- namePattern
- proc-macro1
Self-check
This advisory includes an optional local inspection recipe. Delivery and automated execution depend on the account plan, connected integration, and the release path documented for your environment; verify before relying on it.
Inspect paths
~/.cargo/registry/~/.cargo/git/./target//tmp/%TEMP%\%APPDATA%\~/Library/LaunchAgents/~/.config/systemd/user/
Remediation: uninstall— 1.Check Lockfiles & Dependency Lists
# Check Cargo lockfiles or build logs for compromised package versions
grep -E "(arrayref|internment|append-only-vec|proc-macro1)" Cargo.lock -A2
2.Check Host Artifacts & Active C2 Connections
# (1) Check for malicious stage files / payloads
# Linux / macOS
ls -la /tmp/rust-setup 2>/dev/null && echo "🚨 COMPROMISED: Malicious binary detected"
# Windows (cmd/PowerShell)
dir "%TEMP%\rust-setup*" 2>nul && echo "🚨 COMPROMISED: Windows launcher/payload scripts detected"
# (2)Check for active C2 network connections (Port 9089 / 443)
netstat -ano | grep "23\.254\.165\.112" 2>/dev/null
3.Check & Remove System-Level Persistence
# macOS: Check LaunchAgents
ls -la ~/Library/LaunchAgents/ 2>/dev/null
# Linux: Check systemd user services
systemctl --user list-unit-files | grep -i rust
# Windows: Check Registry HKCU Run Keys (Execute in cmd/PowerShell)
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
4.Check Malicious Loader Hashes (SHA-256)
# Verify build.rs loader from malicious dependency (proc-macro1)
sha256sum ~/.cargo/registry/src/*/*/proc-macro1-*/build.rs 2>/dev/null
# Malicious SHA-256: cb7778eb6dda91028abf087eb7c3553f981a67e756769507d348e8c201805568
# Stage 2 Payload SHA-256 (Linux x86-64 example)
# 408ef22050ffc5a67e005802809026b29f297a8019f8fda91a2afa8e877ba434
5.Full Credential Rotation
If any affected version was built, immediately revoke and rotate all accessible credentials:
- Git / GitHub / GitLab SSH keys and Personal Access Tokens
- Crates.io API Tokens
- Cloud service credentials (AWS / GCP / Azure)
- Saved browser passwords (Chromium-based browser databases are targeted for harvesting)