Malicious Rust Crates Compromise Solana and Ethereum Build Pipelines

The trigger is not a function call. A standard cargo build is sufficient. Any Web3 project compiling these versions inherits a direct path to remote code execution and credential exfiltration.

Attack vector

The attacker added one line to each Cargo.toml: a dependency on proc-macro1, a typosquat of proc-macro2. The malicious logic lives in proc-macro1's build.rs. Cargo compiles build scripts unconditionally during a normal build. Calling a single function from arrayref is not required. Lockfile resolution is the entire precondition.

The build script reconstructs a C2 URL from Base64 fragments, disables TLS certificate validation, downloads a platform-specific payload (Linux x86_64, Windows x86_64, macOS x86_64, macOS aarch64), writes it to disk, and executes it detached. Per the Semgrep advisory, the Linux x86_64 payload is rust-crate_0.1.0 and the macOS aarch64 payload is rust-crate_0.4.0, with SHA-256 hashes published in the advisory. A related lookalike, proc-macro-en, was uploaded under the author name "daveroundy" impersonating the legitimate maintainer "droundy," indicating the campaign was still expanding when the originals were pulled.

Exposure window and scope

The compromised versions are [email protected], [email protected], and [email protected]. StepSecurity estimates per-crate exposure windows of 86, 90, and 107 minutes respectively before all three were removed. Arrayref alone carries roughly 245 million all-time downloads, with 53.7 million in the last 90 days. Every cargo build resolving those versions during those windows detonated the payload. The initial report was filed to RustSec and [email protected] by researcher jhobern.

Payload behavior

The second-stage binary fingerprints the host — username, OS, installed applications — and enumerates Chrome, Brave, and Edge profile directories for saved logins and extensions. Persistence is implemented via Windows Registry Run keys, macOS LaunchAgents, and Linux systemd user services. A domain-generation algorithm produces 10 .com domains every five days as a fallback C2 channel. Wiz reports infrastructure overlap with campaigns attributed to DPRK-linked Sapphire Sleet, including the Mastra operation Microsoft attributed to that actor and the Axios npm supply-chain incident.

Audit checklist

1. Grep Cargo.lock for arrayref 0.3.10, append-only-vec 0.1.9, internment 0.8.7, proc-macro1, proc-macro-en. Remove and rebuild from clean state.

2. Audit any build executed in the exposure window for unexpected outbound connections from the build host.

3. Rotate every credential reachable from any build host that resolved these versions during the window.

4. Pin all transitive macros by exact version. Reject ^ and ~ on build-script dependencies.

5. Block outbound DNS from CI runners except to allowlisted registries. A build script should not need the public internet.

6. Treat build.rs execution as part of the threat model. Run builds in ephemeral containers with no persistent state and no browser profiles.

Typosquatting as a technique is not unique to package registries. Similar lures surface against consumer-facing properties — the same brand-imitation playbook that compromises developer trust through movie and TV show news domains applies here at the dependency layer. The defensive posture is identical in both cases: name resolution alone is not trust. Verify the publisher. Verify the hash. Treat every build script as untrusted code that executes on your machine with your credentials.