Popular Rust crates arrayref, append-only-vec, and internment compromised in Supply Chain Attack

What it is

A supply chain compromise (detected August 20) of three Rust crates from maintainer droundy: append-only-vec (4M downloads), arrayref (244M downloads), and internment (14M downloads). Aikido calls it the largest Rust crate compromise by download count seen to date. The attack vector is a single injected manifest dependency on proc-macro1, a typosquat of the ubiquitous proc-macro2 that copies the real crate's description, author, and docs. A related lookalike, proc-macro-en, was published under author daveroundy (impersonating droundy).

How it works

The crate source is genuine upstream code and references proc-macro1 nowhere. The only change is one line in each manifest:

[dependencies]
proc-macro1 = "1.0.107"

All malicious logic lives in proc-macro1's build.rs, which Cargo compiles and runs automatically. Merely compiling any project pulling in these crates triggers infection — no runtime call to crate functionality is needed. The build script hides its network endpoints as base64 fragments, selects a payload matching the victim's OS/arch (Linux x86_64, Windows x86_64, macOS x86_64, macOS aarch64), and downloads it over HTTPS from 23.254.165.112:9089. On Unix/macOS it writes to /tmp/rust-setup, chmods +x, and spawns it detached with a second address (23.254.165.112:443) as an argument. On Windows it writes a PowerShell script launched hidden via a .vbs/wscript chain to escape Cargo's job object so it survives the build.

The dropped binary is a Rust infostealer (same family across platforms). Its C2 is not hardcoded — it reads the host from its command-line argument (the :443 address the dropper passes), building https://{host}/49890878. It targets Chromium-based browsers (Chrome, Brave, Edge), reading saved credentials from the login database via embedded SQL, and reads Local Extension Settings where browser crypto wallets store data. On macOS it establishes persistence via a LaunchAgent plist with RunAtLoad, executing through /bin/zsh -c.

Preconditions / Affected

Any build environment that pulls in a compromised version of arrayref, append-only-vec, or internment. Because it fires at build time, CI runners and developer machines are equally exposed regardless of whether the crate's functions are ever called.

What to do

The page states no fixed versions or explicit remediation commands. Actionable indicators to hunt/block:

• Packages: proc-macro1, proc-macro-en; author daveroundy.
• Network IOC: 23.254.165.112 (ports 9089 and 443).
• Host artifacts: /tmp/rust-setup; macOS Library/LaunchAgents plist running /bin/zsh -c.
• Audit Cargo lockfiles/manifests for a proc-macro1 dependency.

Caveats

The :443 C2 is not baked into the binary — the same stealer could be reused with a different C2, so the IP indicates this campaign, not the malware family broadly. Aikido analyzed only two of four platform builds (Linux ELF, macOS aarch64 Mach-O); the Windows PowerShell sample they received was a zero-byte file, so its content was not analyzed.