DPRK-Linked Hackers Poisoned a Rust Crate With 245 Million Downloads

On August 20, 2026, three Rust packages were quietly replaced with malicious versions on crates.io — and all it took to trigger the attack was running cargo build.

The compromised crates were arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9. The genuine arrayref crate is maintained by droundy, whose crates.io account appears to have been compromised. All three malicious releases were published from the same account within a short window, and all were removed within 86 to 107 minutes once the Rust Security Response WG was alerted.

How the Attack Worked

The attackers used a straightforward but dangerous technique: instead of altering the crates’ actual code, they added a dependency on a typosquatted crate called proc-macro1 — a near-identical name to the legitimate proc_macro2 used throughout the Rust ecosystem. This fake crate’s build script downloaded and executed a remote binary on the victim’s machine during compilation.

Because Cargo runs build scripts automatically during cargo build, any developer who ran a build against an affected project version unknowingly executed the attacker’s payload. No user interaction beyond a routine build step was required.

Analysis by StepSecurity found the malicious payload deployed an infostealer — targeting credentials, SSH keys, and browser session data. Wiz researchers found significant infrastructure overlap with prior DPRK-linked supply chain campaigns, including attacks on the Mastra framework and the axios npm package. This is consistent with a pattern of North Korean threat actors targeting developer toolchains to compromise the machines of software engineers at high-value organizations.

Scale of Exposure

arrayref is not an obscure crate. It has accumulated 245 million all-time downloads on crates.io, with roughly 53.7 million in the last 90 days alone. Some 403 crates list it as a direct dependency, and it is present in approximately three-quarters of all environments where Rust is deployed. The breadth of potential exposure rivals some of the largest supply chain incidents in open-source history.

The speed of the response — complete removal in under two hours — limited real-world damage significantly. But the attack is a sharp reminder that build-time code execution is a threat vector most development teams do not actively defend against.

What Developers Should Do

If you ran cargo build on a Rust project between approximately 09:00 and 11:00 UTC on August 20, 2026, you should audit your build logs for unexpected network calls. SafeDep has published indicators of compromise, including the known C2 endpoints the build-time dropper contacted.

Going forward, tools such as cargo-deny or StepSecurity’s Harden Runner can monitor outbound network calls during CI builds — a straightforward tripwire against exactly this kind of attack. Pinning dependency versions and enabling crate checksums in your Cargo.lock workflow is equally important.

The Rust Security Response WG has published a full incident report on the Rust Blog. If your organization ships Rust code, it is required reading.