Popular Rust Crate arrayref Hijacked to Spread Infostealer Malware
Security researchers have discovered that arrayref, a small but heavily used Rust crate for slicing arrays into fixed-size references, was compromised by attackers who gained control of the maintainer's package registry account. They pushed a poisoned update containing code that ran during compilation, quietly installing infostealer malware on developers' machines.
Because arrayref is pulled in as a dependency by many other Rust projects, the malicious version could spread far beyond anyone who intentionally chose to use it. Build-time execution is especially dangerous since it runs with a developer's local permissions, potentially exposing credentials, SSH keys, and cloud tokens before anyone notices anything wrong.
The compromised package has since been pulled or patched, but the incident adds to a growing string of supply-chain attacks hitting open-source registries like npm, PyPI, and crates.io.