Executive brief
The append-only-vec crate, a Rust library used in software projects, was compromised and published with a malicious build script that executes arbitrary code during compilation. When a developer builds a project that depends on the affected version, the malware downloads and runs executable code from an attacker-controlled server, potentially giving the attacker complete control over the developer's machine and any systems they deploy code to.
Technical details
This is a supply chain attack via dependency injection in the Rust package ecosystem. The compromised append-only-vec 0.1.9 crate depends on a typosquatted rogue crate (proc-macro1) whose build.rs script downloads a malicious binary from 23.254.165.112:9089 and executes it during the build phase with no user interaction required. The payload is delivered as platform-specific executables (ELF on Unix, PowerShell on Windows) that connect to command-and-control servers. The attack affects the build environment of any developer or CI/CD system that compiles code depending on the malicious version. The malicious version was published on 2026-08-20 and remained accessible for 107 minutes before removal by the Rust Security Response Team.
Affected products
- Rust append-only-vec 0.1.9
- Rust proc-macro1 1.0.107
- Rust arrayref 0.3.10
- Rust internment 0.8.7
Timeline
- 2026-08-20: disclosed: Malicious versions published to crates.io
- 2026-08-20: other: append-only-vec 0.1.9 published
- 2026-08-20: other: append-only-vec 0.1.9 deleted after 107 minutes online
- 2026-08-20: patched: Malicious versions removed and accounts locked by Rust Security Response Team