Malicious arrayref crate ran code at build time — audit Rust deps now
A hijacked maintainer pushed a build-time payload into a crate pulled 245M times. Live ~90 min, it stole browser creds and looks tied to North Korea.
Copy markdown
How it ran without you ever calling it
The malicious proc-macro1 crate — a typosquat of the ubiquitous proc-macro2 — carried a build script that fired during `cargo build`, so simply compiling a dependency was enough to run it. The stage-2 implant then lifted logins from Chrome, Brave, and Edge and installed persistence across Windows, macOS, and Linux.
245M downloads deep, ~90 minutes live
arrayref@0.3.10 (245M all-time downloads, 403 dependents) sat live for 86 minutes before removal; internment@0.8.7 and append-only-vec@0.1.9 followed the same hour. The attacker even yanked the legitimate 0.3.5–0.3.9 releases so the poisoned version looked like the only non-yanked option.
What to do right now
Pin arrayref to 0.3.9 or earlier, grep `~/.cargo/registry/cache` for the pulled versions, and rebuild clean before shipping. Watch for the published IoCs: IP 23.254.165.112, domain hwsrv-798836.hostwindsdns.com, and dropped files in /tmp and %TEMP%.
Fingerprints point at North Korea
Wiz reports substantial overlap with recent DPRK npm campaigns — the Mastra and axios compromises — though no vendor has formally attributed this one. Three separate maintainer accounts were abused inside half an hour, so treat your crates.io publish tokens as burnable and rotate them.
Elsewhere: Gemma crosses 1 billion downloads
Google says its open Gemma models passed 1B downloads with 100,000+ community variants, and shipped an 'Awesome Gemma' repo cataloging tools, tutorials, and community projects — a decent starting map if you're choosing an open base model to build on this weekend.