Arrayref maintainer account hit by network compromise
Incident
Summary
Hide ▲
Show ▼
The arrayref maintainer account was compromised, and malicious crate releases on crates.io executed during compilation on developers’ systems, creating a supply-chain intrusion risk. The same account also poisoned append-only-vec and internment within a 23-minute window, widening exposure across widely used Rust packages. The fake dependency proc-macro1 used a `build.rs` script and platform-specific payloads to run on Linux, Windows, and macOS systems. The payload was built to collect host data and browser credentials, making the compromise a direct theft and persistence risk for developers.
Related Happenings
Proc-macro1 malicious crate payload
Malware Activity
H score29
First: 20.08.2026 20:53
Last: 20.08.2026 20:53
Sources 1
How related:
According to the researchers, a script in proc-macro1, named ‘build.rs,’ is automatically executed during compilation, reconstructing its infrastructure from base64-encoded fragments and selecting a payload that matches the host OS (Linux x86-64, Windows x86-64, macOS x86-64, and macOS ARM64).
About this happening:
A proc-macro1 typosquatted dependency executed a build-time payload during compilation, creating a credential-stealing risk for developers on Linux, Windows, and *...
Proc-macro1 malicious crate payload
Malware ActivityHow related: According to the researchers, a script in proc-macro1, named ‘build.rs,’ is automatically executed during compilation, reconstructing its infrastructure from base64-encoded fragments and selecting a payload that matches the host OS (Linux x86-64, Windows x86-64, macOS x86-64, and macOS ARM64).
About this happening: A proc-macro1 typosquatted dependency executed a build-time payload during compilation, creating a credential-stealing risk for developers on Linux, Windows, and *...
Malicious npm packages delivering a cross-platform RAT to Alibaba developer tools users
Malware Activity
H score37
First: 03.08.2026 21:43
Last: 03.08.2026 21:43
Sources 1
About this happening:
Researchers uncovered 18 malicious npm packages that deliver a cross-platform RAT through a layered dependency tree, putting Alibaba developer tool users in Chinese-...
Malicious npm packages delivering a cross-platform RAT to Alibaba developer tools users
Malware ActivityAbout this happening: Researchers uncovered 18 malicious npm packages that deliver a cross-platform RAT through a layered dependency tree, putting Alibaba developer tool users in Chinese-...
AsyncAPI malicious npm package supply-chain malware
Malware Activity
H score21
First: 15.07.2026 18:37
Last: 15.07.2026 18:37
Sources 1
About this happening:
Malicious AsyncAPI npm releases pushed a remote access trojan and info-stealing payload into packages with more than 2.25 million weekly downloads, putting downstr...
AsyncAPI malicious npm package supply-chain malware
Malware ActivityAbout this happening: Malicious AsyncAPI npm releases pushed a remote access trojan and info-stealing payload into packages with more than 2.25 million weekly downloads, putting downstr...
Compromised @asyncapi npm packages distributing the Miasma loader
Malware Activity
H score29
First: 15.07.2026 12:16
Last: 15.07.2026 12:16
Sources 1
About this happening:
Four compromised @asyncapi npm packages now deliver a multi-stage botnet loader when imported, exposing consumers to Miasma payloads during normal Node.js module load....
Compromised @asyncapi npm packages distributing the Miasma loader
Malware ActivityAbout this happening: Four compromised @asyncapi npm packages now deliver a multi-stage botnet loader when imported, exposing consumers to Miasma payloads during normal Node.js module load....
Jscrambler 8.14.0 malicious preinstall infostealer release
Malware Activity
H score9
First: 11.07.2026 20:59
Last: 11.07.2026 20:59
Sources 1
About this happening:
The jscrambler 8.14.0 npm release now ships a malicious preinstall hook that runs a Rust infostealer during install, putting developer and CI secrets at risk on ...
Jscrambler 8.14.0 malicious preinstall infostealer release
Malware ActivityAbout this happening: The jscrambler 8.14.0 npm release now ships a malicious preinstall hook that runs a Rust infostealer during install, putting developer and CI secrets at risk on ...
Timeline
-
21.08.2026 15:40 1 articles · 13d ago
Wiz links Rust crates.io supply chain attack to North Korean actors
Attribution UpdateWiz researchers linked the Rust crates.io supply chain attack to state-sponsored North Korean threat actors, saying the arrayref infrastructure substantially overlaps with operations attributed to recent North Korean actors. Microsoft and other threat intelligence teams track the actor as Sapphire Sleet, and the network communication patterns, server setups, and endpoint paths mirrored prior supply-chain campaigns.
Show sources
- North Korean Hackers Tied to Rust Supply Chain Attack — www.infosecurity-magazine.com — 21.08.2026 15:40
-
20.08.2026 20:53 3 articles · 13d ago
Arrayref maintainer account hit by network compromise
Initial DisclosureAn attacker first abused the arrayref maintainer account to publish a malicious release on crates.io at 01:55 UTC. The same operation quickly expanded to append-only-vec and internment, creating a short but dangerous supply-chain exposure window.
Show sources
- Hackers poison arrayref Rust crate to push infostealer malware — www.bleepingcomputer.com — 20.08.2026 20:53
- Hackers poison arrayref Rust crate to push infostealer malware — www.bleepingcomputer.com — 20.08.2026 20:53
- Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads — thehackernews.com — 20.08.2026 23:22