Poisoned Pipeline / Incidents / AS18
crates.io arrayref / proc-macro1 build-time dropper
On 20 August 2026 a compromised crates.io maintainer account published
arrayref 0.3.10 (and shortly internment 0.8.7 and append-only-vec 0.1.9)
depending on a new typosquat, proc-macro1, whose build.rs downloaded and
ran a second-stage binary at compile time. An impersonator account
(dtolney) staged the typosquat of David Tolnay's proc-macro2. The Rust
Security Response Team deleted the malicious crates and locked the
account; Nextron Systems reported it. Exposure windows were 86–107 minutes.
On 17 September 2026 the crates.io team warned that rust-lang members
and popular crate owners were still being targeted with fake job or
contract video calls (missing-codec installs, clipboard-pasted
commands) aimed at stealing publish access.
Mapped techniques
- T0113 Compromised user account
- T0108 Accounts in public registry
- T0164 Inject malicious dependency to privileged user repository
- T0136 Brandjacking
- T0141 Fake developer reputation (Starjacking)
- T0129 Typosquatting
- T0110 Advertise malicious artifact
- T0109 Publish malicious artifact
- T0198 Malicious Build Time Dependencies
- T0170 Malicious compiler or interpreter
- T0159 Malicious artifact execution
- T0145 Bypass of outbound traffic control
- T0201 Customers compromised
supply-chain crates.io
The Rust Security Response Team assessed the arrayref author's
machine or credentials as compromised, not a malicious maintainer.
Attacker-owned crates.io accounts published proc-macro1, proc-macro-en,
arone, aronenao and related droppers two days earlier.
The poisoned arrayref release added a first-ever dependency on the
attacker dropper; every consumer of arrayref inherited it.
dtolney impersonated dtolnay / proc-macro2 branding on crates.io.
GitHub account dtolney impersonated David Tolnay (dtolnay), author of
the real proc-macro2, to make the typosquat look like a Tolnay crate.
proc-macro1 is a one-character typosquat of proc-macro2.
Clean arrayref 0.3.x releases were yanked so Cargo herded builders
toward the one remaining poisoned release.
Poisoned versions of three legitimate crates plus dropper crates were
published to crates.io.
arrayref itself had no malicious Rust source; the weapon was a new
build-time dependency whose build.rs ran at compile time.
cargo build was enough to detonate; the crate never needed to be called.
post-supply-chain Downstream Rust builds
Any project whose lockfile resolved the poisoned versions executed the
dropper during cargo build.
build.rs fetched the payload over TLS with certificate validation
disabled to an IP that no Rust build should contact.
arrayref sits under tiny-skia, winit, blake3 and large crypto/GUI stacks
(~245M downloads). Anyone who built during the window is in scope.
Framework gaps noted
- Yank-to-herd (deleting safe versions so the only remaining version is malicious) is not a named technique.
Sources
- https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref
- https://blog.rust-lang.org/2026/09/17/targeted-attacks/
- https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack
- https://github.com/rustsec/advisory-db/issues/3161
- https://safedep.io/arrayref-proc-macro1-rust-build-time-malware
- https://www.aikido.dev/blog/two-popular-rust-crates-arrayref-and-append-only-vec-compromised-in-supply-chain-attack
- https://socket.dev/blog/popular-rust-crates-compromised