ON August 20, 2026, a supply chain attack targeted Rust developers via malicious versions of three crates (arrayref, internment, and append-only-vec) uploaded to crates.io. The attack involved a typosquatted dependency named proc-macro1, which mimicked a legitimate crate and contained a build script designed to execute malware during the compilation process. The malicious crate was live for about 86 minutes before being deleted and the maintainer's account was locked.
The malware communicated with a command and control server, stealing details and compromising user accounts. Attribution remains unconfirmed, but overlaps with North Korean activities suggest possible involvement. Developers are advised to check their environments for the affected versions and take steps to mitigate risk.