A malicious version of arrayref, a small utility crate widely used across Rust projects, shipped a build script that downloaded and executed a remote binary during compilation, according to security research firm SafeDep.
The compromise centered on arrayref 0.3.10, which introduced a dependency on a poisoned release of proc-macro1, a supporting crate published by the same account, SafeDep said. Related crates internment 0.8.7 and append-only-vec 0.1.9, also published by that account, carried the same payload, according to SafeDep's writeup.
The build script ran during `cargo build`, before any application code executes, and fetched an operating-system-specific binary. On Unix systems it wrote an executable to /tmp/rust-setup and launched it with a command-and-control address as an argument; on Windows it used a PowerShell script launched through WScript to escape Cargo's job object so the payload could keep running after the build finished, SafeDep said.
Crates.io removed the malicious releases after the compromise was reported, and the publishing account has been locked, SafeDep said. The firm published indicators of compromise, including network connections to 23.254.165.112 on ports 9089 and 443, and urged developers who built against the affected versions to check for those connections and rotate any credentials exposed on affected machines.
Build scripts run with the full permissions of whoever runs `cargo build`, with no sandbox and no prompt, which is exactly why they're a favorite spot for supply chain attacks. Anyone who pulled arrayref, proc-macro1, internment or append-only-vec recently should check their lockfiles against the versions SafeDep flagged, not just wait for a dependabot alert to catch it.