arrayref and Other Rust Crates Hijacked in Supply Chain Attack (Campaign)

On August 20, 2026, attacker-controlled malicious versions of several Rust crates (including arrayref) were published to crates.io via a compromised maintainer account; the packages introduced a typosquatted dependency (proc-macro1) whose build script reconstructed a download server, retrieved a second-stage multi-platform infostealer/RAT (deployed as platform-specific archives), wrote and executed it on build, and thereby enabled credential and system data exfiltration, persistence (systemd user service, HKCU Run, LaunchAgent), and remote command execution to HTTPS C2 endpoints. The malicious versions were available for under two hours before removal; only projects that resolved dependencies from scratch or ran cargo update during that window were affected, and earlier crate versions were yanked and later restored.