Socket: Popular Rust Crates Compromised in Build-Time Supply Chain Attack

What it is

A build-time supply chain attack (disclosed August 20, 2026) against three legitimate Rust crates maintained by David Roundy (droundy): arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9. Each republished release added a dependency on proc-macro1 (= "1.0.107"), a typosquat of proc-macro2 whose build.rs executes automatically during Cargo compilation. The Rust Security Response Team removed the releases and locked the account, believing the maintainer's machine or crates.io credentials were compromised rather than the maintainer acting maliciously.

How it works

The compromised crates contain no obviously malicious code — the payload lives in proc-macro1's build.rs, which Cargo runs during compilation without the application importing anything. The loader reconstructs Base64-split C2 addresses, detects OS/architecture, disables TLS certificate verification, downloads a platform-specific payload from 23[.]254[.]165[.]112:9089, and runs it passing 23[.]254[.]165[.]112:443 as the C2 endpoint. The IP is not embedded in stage-2 — it is passed at runtime, letting the actor rotate infrastructure without rebuilding implants.

Stage-2 drop paths:

• Linux/macOS: /tmp/rust-setup (made executable, launched detached)
• Windows: %TEMP%\rust-setup.ps1 and %TEMP%\rust-setup-launch.vbs, launched via wscript.exe running hidden PowerShell with ExecutionPolicy Bypass

The backdoor profiles the host, inventories Chromium browsers (login origins, usernames, extension IDs — it does not decrypt stored passwords in the analyzed stage), persists via HKCU Run key / systemd user service / LaunchAgent, and beacons to /49890878. If the primary C2 is unreachable it falls back to ten deterministic date-based .com DGA domains and permanently adopts the first responsive one.

Preconditions / Affected

Any system that built one of the three malicious versions — a normal cargo build is sufficient; no runtime execution of the crate is needed. The actor also yanked older legitimate arrayref releases to steer resolution toward malicious 0.3.10 (later restored).

What to do

Treat any host that built an affected version as potentially compromised. Related actor-controlled packages removed from crates.io: proc-macro-en (contained the same malicious build.rs as proc-macro1@1.0.107), plus staging clones aovine, arone, aronenao, and tinymember. Hunt for the drop paths above, the beacon URI, and the C2 IP.

Key IOCs:

• C2 / payload host: 23[.]254[.]165[.]112 (ports 9089 download, 443 C2)
• Beacon path: /49890878

Caveats

Socket found little anti-analysis beyond the Base64-split infrastructure. The same RSA private key is embedded across all recovered payloads with no exclusive operator authentication; combined with the predictable DGA this enables defensive sinkholing and victim identification — but Socket explicitly warns defenders should not issue commands to third-party systems.