On 20 August 2026 somebody published a malicious version 0.3.7 of arrayref to crates.io.

That name will mean nothing to most readers and everything to Rust developers. arrayref has more than 245 million downloads and is reported to be present in roughly 75% of Rust environments — a small utility crate that ended up underneath an enormous amount of software.

The Rust Security Response Team removed it about 86 minutes after publication.

Compiling is enough

The mechanism is the part worth understanding, because it is not how most people picture a supply-chain attack.

The poisoned arrayref took a dependency on proc-macro1 — a package impersonating the entirely legitimate and extremely common proc-macro2 — and that package carried a malicious build.rs.

In Rust, build.rs is a build script. It runs at compile time, on the machine doing the compiling, before anything ships and before anyone runs the program. You do not have to execute the application to be compromised. Running cargo build is the execution.

That is why the window matters so much more here than in a normal dependency attack. Every CI runner, every developer laptop, every container image build that pulled dependencies during those 86 minutes ran the script.

What the script did

It fetched a platform-specific second-stage binary over TLS after disabling certificate validation.

Turning off certificate checking in malware is a small detail with a large tell inside it. It means the operator did not want to manage a valid certificate on the delivery host, and it also means the download could be intercepted or replaced by anyone positioned on the path. Whoever wrote this was optimising for convenience rather than for operational security, which is not the profile of a careful long-term implant.

Two more crates from the same maintainer — internment and append-only-vec — got the same treatment about 20 minutes later. The Rust team's assessment is that the maintainer's credentials were likely compromised, and that it found no evidence the malicious packages were actually used.

The attribution, and how firm it is

Wiz attributes the attack to Sapphire Sleet, a North Korean threat actor, on the basis of infrastructure overlaps:

  • Command-and-control endpoints identical to those in the Mastra npm attack of June 2026
  • C2 traffic routed through an IP address used in the Axios campaign of April 2026
  • Shared Hostwinds LLC infrastructure across all three incidents

Infrastructure overlap is real evidence and it is not the same as proof. Reused endpoints and hosting can indicate the same operator, a shared service, or one crew borrowing another's infrastructure. Wiz's confidence is its own; we are reporting the basis rather than adopting the conclusion.

What the overlap does establish more firmly is that this is the third package-ecosystem attack from a connected set of infrastructure in five months, across npm and now crates.io.

Rust was supposed to be the safe one

The reason this stings is cultural.

Rust's entire pitch is memory safety — a language that makes an enormous category of vulnerability impossible by construction. And it does. None of that has anything to do with this. Memory safety governs what your code can do wrong; it says nothing about whether the code you pulled in is yours.

crates.io has also been comparatively quiet while npm absorbed the Shai-Hulud worm and 846 malicious packages in a flooding campaign. A smaller ecosystem is a smaller target until it is worth attacking, and 245 million downloads is worth attacking.

What to do

  • Check whether any build pulled arrayref 0.3.7, internment or append-only-vec on 20 August. CI logs and lockfile diffs are where the answer is.
  • If a build did, treat that runner as compromised, not the artefact. The payload ran on the builder.
  • Rotate whatever that builder could reach. Registry tokens, cloud credentials, signing keys — the standard CI secrets problem.
  • Pin dependencies and commit your lockfile. This attack required a build to resolve a new version inside a 86-minute window. A committed lockfile closes that.
  • Use vendored or mirrored registries for production builds. A cache that lags the upstream by a day would have missed this entirely.
  • Look at typo-adjacent dependency names in your tree. proc-macro1 against proc-macro2 is the whole trick and it is legible to a human reading a diff.

What is not established

  • Whether anyone was actually compromised. The Rust team reports no evidence of malicious use.
  • The attribution. Wiz's Sapphire Sleet assessment rests on infrastructure overlap.
  • How the maintainer's credentials were taken. Assessed as compromised; the route is not published.
  • What the second stage did. The delivery mechanism is described; the payload's behaviour is not.