Popular Rust Crates Compromised in Build-Time Supply Chain Attack
Brief
A threat actor compromised legitimate Rust crates and injected a malicious proc-macro1 dependency that executed cross-platform malware automatically during Cargo builds. Socket’s Threat Research Team analyzed a coordinated supply chain attack affecting three legitimate Rust crates maintained by David Roundy ( droundy ):
- arrayref@0.3.10
- internment@0.8.7
- append-only-vec@0.1.9
Socket’s AI Scanner independently detected the malicious proc-macro1 crate on August 20, 2026 at 07:29:50 UTC. At that point only arrayref@0.
- 10 had been republished with the malicious dependency; malicious internment@0.
- 7 and append-only-vec@0.
- 9 were published minutes later. Our subsequent analysis of the affected and related crates and recovered malware payloads confirmed the broader attack.