FuriaHubMalicious crate hit Rust’s arrayref package for 86 minutes
The Rust Security Response Team said a malicious proc-macro1 crate used a build script to download a payload, and that the popular arrayref crate was republished to depend on it. arrayref 0.3.10 was online for 86 minutes, from 07:15 to 08:41 UTC.
On August 20, 2026, the Rust Security Response Team said it verified that the proc-macro1 crate was malicious. A build script downloaded a payload, and the widely used arrayref crate had been republished to depend on it.
What we know
- arrayref 0.3.10 was published at 07:15 UTC and deleted at 08:41 UTC — 86 minutes online.
- internment 0.8.7 was online for 90 minutes; append-only-vec 0.1.9 for 107 minutes.
- Related crates proc-macro1, proc-macro-en, aovine, arone, aronenao, and tinymember were deleted.
- The team does not believe the arrayref author acted maliciously and said their computer or credentials were likely compromised; Nextron Systems reported the attack.
Takeaways
- The malicious arrayref release lived on crates.io for under an hour and a half.
- Two other crates by the same author were yanked the same morning.
- Responders treat the author as a likely compromise victim, not the attacker.
Source: Rust Blog
