Poisoned Rust crates turned routine builds into credential theft for about 90 minutes each

Attackers published malicious releases of three widely used Rust crates on August 21, 2026: arrayref 0.3.10, with 245 million lifetime downloads, internment 0.8.7, and append-only-vec 0.1.9, all maintained by the same developer. A typosquatted proc-macro1 and several throwaway crates carried the payload, which targeted Chrome, Brave, and Edge browser profiles and cryptocurrency wallet extensions, established persistence, and accepted attacker commands on Linux, Windows, Intel Macs, and Apple Silicon. Exposure windows were 86, 90, and 107 minutes before crates.io removed them. The Rust team suspects the maintainer's machine or credentials were compromised but has not stated how.

Why it matters

A 90-minute window is not a small one when CI runs on every push. Any pipeline that resolved a fresh dependency graph in that period pulled the payload, and unlike a developer laptop, a build runner holds registry tokens, cloud credentials, and signing keys. The compromise path here is the recurring one in package ecosystems: the maintainer account rather than the code. Publishing credentials are long-lived, often unrotated, and frequently protected by nothing stronger than a password. Concrete steps: pin and commit Cargo.lock, check lockfiles and local registry caches for the affected versions, require phishing-resistant MFA on publish accounts, and scope publish tokens to single crates. Rotate anything a build runner touched during the window.

Source: The Register