Compromised Maintainer Account Leads to Malicious Build Scripts in Popular Rust Crates

The Rust Project has removed malicious releases of three widely used crates — arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 — after a compromised maintainer account published versions that pulled in a typosquatted dependency. That dependency's build script downloaded and executed a remote payload during compilation.

What was reported

According to The Hacker News, all three malicious releases were published from the same compromised owner account on crates.io. The tampered versions added a typosquatted dependency whose build.rs script fetched and ran remote code at build time, rather than at runtime — meaning the malicious activity could execute simply by compiling the crate, not by using it.

Why it matters

These three crates collectively account for a combined 245 million downloads, and Rust build scripts run with the full privileges of the user invoking cargo build — with no sandboxing by default. Any developer or CI pipeline that pulled the affected versions during the exposure window could have executed attacker-controlled code, regardless of whether the crate's actual functionality was ever used. This is a build-time supply chain compromise, which is harder for many organizations to monitor than typical runtime dependency risk.

What defenders should do now

• Audit Cargo.lock files across repositories and CI history for the specific affected versions (arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9) and pin or roll back to known-good releases.
• Review build/CI logs for unexpected outbound network connections during cargo build, particularly from build scripts (build.rs) rather than compiled binaries.
• Inventory dependencies for typosquatted or unfamiliar package names introduced alongside legitimate crates in recent lockfile diffs.
• Consider restricting outbound network access for build environments, and evaluate tooling that sandboxes or flags crates with build scripts making network calls.
• Rotate credentials/secrets accessible to any CI runners or developer machines that built the affected versions during the exposure window.

This is a developing story and details of the compromise's scope and timeline may evolve. For the original reporting, see The Hacker News.