# Popular Rust crates arrayref, append-only-vec, and internment compromised in Supply Chain Attack

Attacker injected a malicious proc-macro1 dependency into popular Rust crates, whose build.rs downloads and executes an infostealer on developers' machines at compile time.

- Payout: Real-world hack
- Severity: critical
- Program: Rust crates
- Analysis by: Aikido Security
- Disclosed: 2026-08-20
- Write-up quality: 7/10
- Original: https://www.aikido.dev/blog/two-popular-rust-crates-arrayref-and-append-only-vec-compromised-in-supply-chain-attack
- Library page: https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-two-popular-rust-crates-arrayref-and-append-only-vec-compromised-in-supply-chain-attack
- Tags: area:oss domain:oss impact:data-leak impact:integrity impact:mass-exploit kind:incident platform:threat-intel sev:critical tech:rust technique:recon technique:source-review vuln:dependency-confusion vuln:secrets-leak

**Target:** Rust crate build scripts / Cargo dependency manifests
**Root cause:** Compromised maintainer accounts published new versions of arrayref, append-only-vec, and internment with a single injected dependency on typosquat proc-macro1, whose build.rs downloads and executes a platform-specific payload during Cargo build.
**Steps:**
1. Identify new crate `proc-macro1` typosquatting `proc-macro2`, copying its description/author/docs
2. Observe popular crates from same maintainer suddenly depend on it: `proc-macro1 = "1.0.107"` in Cargo.toml
3. Inspect proc-macro1 build.rs: base64 fragments decode to `https://23.254.165.112:9089/` and C2 `23.254.165.112:443`
4. Build script selects payload by OS/arch, GETs it over HTTPS
5. On Unix/macOS writes to `/tmp/rust-setup`, `chmod +x`, spawns detached with C2 arg, stdio nulled
6. On Windows writes PowerShell script launched hidden via wscript/.vbs to escape Cargo job object
7. Payload registers with C2 at `https://{host}/49890878`, polls for commands (minicfg, startup, runscript, Shell, ShellX)
8. Infostealer queries Chromium `logins` SQLite DB and Local Extension Settings for wallet data; macOS installs LaunchAgent with RunAtLoad
**How found:** Pipeline flagged proc-macro1 as new package downloading and executing a remote file; initially dismissed as low-download typosquat until within the same hour multiple popular crates from the same maintainer began depending on it, escalating to a supply chain incident.
**Exploitation:** Any developer or CI building a project depending on the compromised crates triggers build.rs execution, which downloads and runs the infostealer, exfiltrating browser-saved credentials and crypto wallet extension data to the C2, with LaunchAgent persistence on macOS and polling for remote commands.
**Escalation:** Single injected dependency line across three high-download crates (244M+ downloads) massively scales blast radius; lookalike packages (proc-macro-en) impersonating maintainer droundy extend campaign.
**Insight:** Monitor for new low-download typosquat packages that suddenly gain dependencies from high-profile maintainers — the pivot from 'noise' to 'incident' is the dependency graph edge, not the package itself; also check build.rs for base64-fragmented URLs and detached process spawning.