Arrayref Rust Crate Hijacked to Run Malware While Your Project Compiled

Sun, 23 Aug 2026 14:02:40 +0200

Your Rust build pulled in a backdoor for 86 minutes on Thursday. Five versions with 246 million downloads between them were pulled in 16 seconds, leaving one poisoned release to land on.

At 07:15 UTC on 20 August a new version of a Rust package called arrayref showed up on crates.io. That package had been sitting there since August 2015. One file, 327 lines of code, nine kilobytes on disk, and it does one small job: it lets you grab a fixed number of bytes out of a longer run of them. In almost eleven years it had never needed anything else to do that.

Rust on HackingPassion.com : root@HackingPassion.com-[~]

Arrayref Rust Crate Hijacked to Run Malware While Your Project Compiled