Executive brief
The internment Rust library version 0.8.7 was compromised and published with a malicious dependency that downloads and executes arbitrary code during project compilation. Any developer who compiled a project using this version would have their build system execute attacker-controlled code, potentially giving the attacker full control of their development machine, build pipeline, and access to sensitive credentials or source code.
Technical details
The internment crate 0.8.7 was republished with a rogue dependency (proc-macro1) containing a build script that downloads and executes a remote binary from 23.254.165.112:9089. The vulnerability is a supply-chain attack vector: when a developer runs `cargo build` on a project depending on internment 0.8.7, the build process executes the attacker-controlled payload automatically, with no user interaction required. The malicious code spawns a detached process on Unix systems (/tmp/rust-setup) and Windows systems via PowerShell, establishing command-and-control communication. The attack vector is network-based with no authentication required—any developer fetching this crate version from crates.io was affected. The crate was yanked and removed from crates.io within 90 minutes of publication; patches were applied by removing the malicious versions and restoring clean dependencies.
Affected products
- Rust internment 0.8.7
Timeline
- 2026-08-20: disclosed: Supply chain attack reported to Rust Security Response Team; malicious crate published
- 2026-08-20: other: Malicious version deleted from crates.io after 90 minutes online
- 2026-08-21: advisory: CVE-2026-77649 published