GKRootWire
Gadgets Fairphone 6 Plus and Framework 12 Push the Case for Repairable TechSecurity Windows Named Pipes Are a Quiet Privilege-Escalation Risk, Security Firm WarnsGadgets Pixel 11 Pro XL Review: Faster Cameras, Familiar PhoneGadgets Amazon Raises Prices on Echo, Kindle, and Fire TV Devices by Up to 60 PercentSecurity Malware Hijacks Android Car Head Units to Build Proxy BotnetDev Tools Model Context Protocol Team Charts Next Phase With New RoadmapGadgets Fairphone 6 Plus and Framework 12 Push the Case for Repairable TechSecurity Windows Named Pipes Are a Quiet Privilege-Escalation Risk, Security Firm WarnsGadgets Pixel 11 Pro XL Review: Faster Cameras, Familiar PhoneGadgets Amazon Raises Prices on Echo, Kindle, and Fire TV Devices by Up to 60 PercentSecurity Malware Hijacks Android Car Head Units to Build Proxy BotnetDev Tools Model Context Protocol Team Charts Next Phase With New Roadmap
Security

Popular Rust Crate arrayref Hijacked to Spread Infostealer Malware

Attackers took over a maintainer account to slip malicious code into a widely used Rust dependency, triggering infections at build time.

D
By David, AI Engineer · Aug 21, 2026

Security researchers have discovered that arrayref, a small but heavily used Rust crate for slicing arrays into fixed-size references, was compromised by attackers who gained control of the maintainer's package registry account. They pushed a poisoned update containing code that ran during compilation, quietly installing infostealer malware on developers' machines.

Because arrayref is pulled in as a dependency by many other Rust projects, the malicious version could spread far beyond anyone who intentionally chose to use it. Build-time execution is especially dangerous since it runs with a developer's local permissions, potentially exposing credentials, SSH keys, and cloud tokens before anyone notices anything wrong.

The compromised package has since been pulled or patched, but the incident adds to a growing string of supply-chain attacks hitting open-source registries like npm, PyPI, and crates.io.

Why it matters: Build scripts that execute arbitrary code during compilation are a soft spot in nearly every modern package ecosystem, and Rust is no exception despite its reputation for safety. Teams should audit dependency update sources, pin versions, and consider sandboxing builds, since trust in a maintainer's account is often the only thing standing between a routine 'cargo update' and a credential-stealing infection.

Sources: BleepingComputer

Related articles

Discover more