Poisoned Rust crate ran malware at build time inside a 245-million-download library

Attackers briefly poisoned arrayref, a foundational Rust crate with about 245 million downloads that sits underneath widely used graphics and blockchain libraries, along with two sibling crates from the same maintainer account. The crate code itself was clean; each added a dependency on a typosquat of a popular package whose build script ran during compilation, pulling and executing an infostealer that grabbed host data and browser credentials. Because the malicious code lived in a build script, simply compiling a project that resolved the crate ran it, with nothing from the library needing to be called. The bad versions were pulled within about ninety minutes, but any build during that window was exposed.

Check

If you build Rust projects, check whether arrayref, internment, or append-only-vec resolved during the exposure window, search the Cargo cache for the malicious files, and pin arrayref to 0.3.9 or earlier.

Affected

Rust developers and CI systems that resolved the poisoned crate versions during the window; the malicious build script ran an infostealer at compile time, taking host information and browser credentials.

Fix

Build with committed lockfiles and the locked flag to avoid pulling fresh malicious versions, enable two-factor authentication on registry accounts, and treat any machine that built during the window as potentially compromised.