Security firms uncover a supply chain attack on Rust crates, executing remote payloads during builds and exposing Solana ecosystem dependencies.
Security researchers identified a coordinated supply chain attack targeting three Rust crates: arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9. The malicious releases included a typosquatted dependency that executed a remote payload during compilation, potentially compromising developer and CI environments.
The affected crates, particularly arrayref, are widely used in the Rust ecosystem, including projects tied to the Solana blockchain. Rust’s security team removed the malicious releases and locked the compromised maintainer account, citing likely credential theft. No downstream projects were confirmed as compromised.
The attack highlights vulnerabilities in open-source dependency chains, with implications for developers relying on Rust-based tools, especially in blockchain and decentralized finance.