Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

A compromised crates.io maintainer account published malicious versions of arrayref, internment, and append-only-vec on 2026-08-20 that added a typosquatted dependency (proc-macro1) whose build script reconstructed a C2 address, disabled TLS validation, downloaded and executed OS-specific payloads during cargo build, and installed persistence; the releases were removed within 86–107 minutes, advisories and IoCs were published, and no confirmed widespread exploitation was reported.