Malicious Rust Crates With 245M Downloads Executed Malware at Compile Time

A compromised crates.io maintainer account published malicious versions of three Rust crates — arrayref, internment, and append-only-vec — on August 20, 2026, between 07:15 and 09:26 UTC. Each release injected a hidden dependency on proc-macro1, a typosquat of the legitimate proc-macro2, whose build script silently downloaded and executed a remote payload during compilation without requiring any function call. The stage-two implant targeted Windows, macOS, and Linux systems, stealing credentials from Chrome, Brave, and Edge browsers. The Rust Security Response Team, acting on a tip from Nextron Systems, removed all three releases within roughly 86 to 107 minutes of publication. No CVE or patched release exists; developers are advised to pin arrayref at version 0.3.9 or earlier, clear the local Cargo registry cache, and block the identified malicious crate names.