Rust Supply Chain Attack Poisons Popular Crates to Steal Developer Credentials

A critical supply chain attack targeted three widely used Rust crates — arrayref, internment, and append-only-vec — by compromising their publisher accounts on crates.io and releasing malicious versions. The tampered crates added hidden dependencies on typosquatted packages and a build.rs script that automatically executed during normal Cargo build or test operations, requiring no additional user action. The malware disabled TLS verification, downloaded a second-stage payload, and collected credentials from browsers and development environments before sending them to attacker-controlled servers. The malicious versions were publicly available for roughly two hours, meaning any developer or CI/CD pipeline that resolved dependencies during that window may be compromised. Security researchers recommend auditing Cargo.lock files for the affected versions, restricting build-time network egress, scoping CI secrets to individual jobs, and rebuilding any potentially affected machines.