Incident case file

Rust Crates Supply Chain Attack — arrayref, internment, append-only-vec

Incident date 2026-08-19Last updated Aug 26, 2026

2 views

ContainedChain-agnostic (Rustcrates.io ecosystemheavily used in Solana and broader Web3 tooling)Supply chain attack — malicious dependency injection (typosquat build-script malware, 86-107 minute exposure window)Cluster: RUST-SUPPLY-2026-08

Estimated loss

Victims identified

Victim group joining is coming soon.

Investigation

100%

Facts and investigation

Ledger

Attacker

Compromised maintainer account (droundy). Wiz's threat intelligence found substantial infrastructure overlap (shared beacon path, SSL issuer, and Hostwinds LLC hosting) with the North Korea-linked Sapphire Sleet cluster and its prior 'Mastra' operation — this attribution is reported by a named security firm but is not treated as definitively nominative.

Funds moved to

No confirmed exploitation or fund theft. The Rust Security Response Team stated there is 'no evidence of actual usage' of the malicious payload before the compromised versions were pulled from crates.io.

Linked

Malicious versions of three widely-used crates (arrayref@0.3.10 — 245M+ cumulative downloads, present in roughly 75% of cloud Rust environments; internment@0.8.7; append-only-vec@0.1.9) each added a dependency on a typosquatted package, proc-macro1 (impersonating the legitimate proc-macro2), whose build.rs script downloaded and executed cross-platform malware during `cargo build`.

Chronology

1 beat

Aug 20, 2026, 07:11 UTC: The malicious dependency proc-macro1 v1.0.107 is published to crates.io. 07:15 UTC: arrayref@0.3.10 is published, adding the proc-macro1 dependency. 07:34 UTC: internment@0.8.7 is published with the same malicious dependency. 07:37 UTC: append-only-vec@0.1.9 follows. 07:38 UTC: The publication window closes. 08:41 UTC (86 minutes after publication): arrayref@0.3.10 is pulled from crates.io. 09:04 UTC (90 minutes): internment@0.8.7 is pulled. 09:25 UTC (107 minutes): append-only-vec@0.1.9 is pulled, closing the exposure window. Aug 21, 2026 (UTC+8): SlowMist publishes a security disclosure flagging the incident to the broader crypto/Web3 developer community, given arrayref's heavy usage across Solana and other blockchain tooling. Wiz's subsequent analysis links the infrastructure (beacon path, SSL certificate issuer, and hosting provider) to the same cluster behind the earlier 'Mastra' operation, attributed with substantial confidence to the DPRK-linked Sapphire Sleet group, though this remains a firm's threat-intelligence assessment rather than a formally adjudicated attribution. Recommended remediation for affected developers: verify Cargo.lock for the compromised versions, scan the local ~/.cargo/registry/cache, rotate any credentials potentially exposed during the build window, and update to patched crate versions.

Sources and coverage

Victim testimonies

No testimonies yet.

+ Add my testimony → (coming soon)