Optimus Labs logo
All briefings
Optimus Labs · CivilizationsCRITICAL · SUPPLY CHAIN

arrayref: a Poisoned Rust Crate Hits the AI Build Endpoint

The DPRK crew behind the Mastra AI-framework attack poisoned arrayref so its build script runs a credential stealer during cargo build, on the developer or CI endpoint that builds your AI tooling, not on your inference nodes.

PackageAgent

Full advisory deck

Organizations in this briefing

Ccrates.io
RRustSec
WWiz
SStepSecurity
SSemgrep

Key takeaways

4 min read
  • The DPRK crew behind the Mastra AI-framework attack poisoned arrayref so its build script runs a credential stealer during cargo build, on the developer or CI endpoint that builds your AI tooling, not on your inference nodes.
  • Blast radius: Every developer laptop and CI runner that compiled arrayref 0.3.10, internment 0.8.7 or append-only-vec 0.1.9, directly or transitively, ran attacker code at compile time. arrayref carries ~245M all-time downloads and Wiz places it in roughly three quarters of Rust environments. The malicious versions were live about 86 minutes and RUSTSEC-2026-0260 states there is no evidence of actual usage. Real downstream reach is GUI (winit, egui, eframe, iced via tiny-skia), crypto/hashing (blake2b_simd, blake2s_simd, older blake3) and blockchain (Ethereum, Solana). No AI/ML framework is a named victim: candle, tokenizers, safetensors and qdrant-client do not depend on arrayref, and pure-Python stacks are not directly hit.
  • CRITICAL · SUPPLY CHAIN
Blast radius
Every developer laptop and CI runner that compiled arrayref 0.3.10, internment 0.8.7 or append-only-vec 0.1.9, directly or transitively, ran attacker code at compile time. arrayref carries ~245M all-time downloads and Wiz places it in roughly three quarters of Rust environments. The malicious versions were live about 86 minutes and RUSTSEC-2026-0260 states there is no evidence of actual usage. Real downstream reach is GUI (winit, egui, eframe, iced via tiny-skia), crypto/hashing (blake2b_simd, blake2s_simd, older blake3) and blockchain (Ethereum, Solana). No AI/ML framework is a named victim: candle, tokenizers, safetensors and qdrant-client do not depend on arrayref, and pure-Python stacks are not directly hit.

Summary

A compromised maintainer account (droundy) and an impersonation account (dtolney, mimicking dtolnay) published malicious arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 to crates.io. Each added a typosquatted dependency, proc-macro1 (mimicking proc-macro2), whose build.rs downloads and runs a stage-2 implant during compilation. Building an affected project, locally, in CI or through an AI coding agent, runs it. This is not a model backdoor. The payload runs at compile time, so the target is the machine that builds AI tooling, and what the actor wants is that host's credential store.

What happened

  • 01:17 UTC: a fake GitHub account is created. 07:15: malicious arrayref 0.3.10 goes live on crates.io. 07:54: reported to RustSec. 08:03: proc-macro1 deleted. 08:41: arrayref pulled. Total exposure window roughly 86 minutes.
  • arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 each added the typosquatted dependency proc-macro1. Its build.rs fetches and runs a stage-2 implant during `cargo build`, so compilation alone is execution.
  • Confirmed payload behavior (Wiz, StepSecurity, BleepingComputer): a cross-platform stealer/backdoor for Linux, Windows and macOS on x86_64 and aarch64. It reads Chrome, Brave and Edge saved logins from their SQLite Login Data databases and collects host credentials.
  • It persists through Registry Run keys, LaunchAgents or systemd, and beacons to C2 over HTTPS at path /49890878, with a DGA fallback of 10 .com domains every 5 days.
  • Attribution is strong overlap, not vendor-confirmed here. Wiz reports the C2 path /49890878 matches the Mastra AI-agent-framework campaign that Microsoft attributed to DPRK / Sapphire Sleet, a victim-reported IP appears in Mandiant/Google analysis of UNC1069's axios npm attack, and both campaigns use the Hostwinds 23.254.164.0/23 range.

Why it matters

  • Every build runs on an endpoint. The stealer runs, persists and beacons from a developer laptop or CI runner, never from an inference node.
  • AI teams build a lot of Rust: tokenizers, serving and inference layers, checkpoint-hashing crypto, data pipelines, CLI tooling, dashboards. A poisoned transitive crate runs on the machines that hold AI secrets.
  • A lockfile scan flags the crate. Only the endpoint shows that a build ran it, what it stole, and whether it persisted.
  • Nobody installs arrayref on purpose. It arrives transitively, which is why a foundational crate with ~245M downloads is a better lever for this actor than any AI framework.
  • There is no patched release. Remediation is a downgrade, which makes lockfile hygiene and build provenance the durable controls rather than a version bump.

What to do

  1. 1Grep every Cargo.lock, CI job and container image for arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9 and any proc-macro1.
  2. 2There is no patched release. Pin arrayref at or below 0.3.9, internment 0.8.6, append-only-vec 0.1.8, then rebuild clean.
  3. 3Treat any laptop or CI runner that built a malicious version as breached: rotate its credentials, check persistence, reimage.
  4. 4Put endpoint detection on build machines, and keep cargo build off inference nodes.

Remediation

Contain now (0-24h)
  • Grep every Cargo.lock, CI job and container image for arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9 and any proc-macro1 or proc-macro-en.
  • Hunt the IoCs: /tmp/rust-setup on Unix, %TEMP%\rust-setup.ps1 and %TEMP%\rust-setup-launch.vbs on Windows, egress to 23.254.165[.]112:9089 and :443, secondary 23.254.167[.]107:443, hwsrv-798836.hostwindsdns[.]com, C2 path /49890878.
  • On build endpoints, watch process lineage: cargo or rustc spawning curl, powershell or wscript, and writes to /tmp/rust-setup.
  • No patched release exists (RUSTSEC-2026-0260). Downgrade and pin arrayref at or below 0.3.9, internment at or below 0.8.6, append-only-vec at or below 0.1.8, then rebuild clean.
Investigate, assume breach (24-72h)
  • Rotate cloud and model-registry tokens first (AWS, GCP, Azure, S3, GCS, HF Hub): they unlock models, checkpoints and data.
  • Then rotate Hugging Face and Weights & Biases keys, crates.io and npm publishing tokens, and code-signing keys, because those enable the next poisoning.
  • Then rotate GitHub and GitLab PATs, CI/CD secrets, vector-DB and LLM-provider keys, SSH keys, and invalidate browser sessions.
  • Check persistence (Registry Run keys, LaunchAgents, systemd) and review egress since 07:15 UTC on Aug 20.
  • Reimage any dev or CI endpoint that built a malicious version. Do not clean in place: this is a full backdoor with persistence.
Harden strategically
  • Put endpoint detection on build machines: lockfile scanning cannot see execution, persistence or exfiltration, only the endpoint can.
  • Separate build from runtime so inference nodes never run cargo build, and sandbox build.rs, which executes arbitrary code at compile time.
  • Scope CI secrets so build jobs cannot reach production model-deploy keys.
  • Commit Cargo.lock, run cargo-audit and cargo-deny in CI, watch RustSec alongside PyPI and npm, and require build provenance or attestation.

Leaked by association

EntityIdentifier
Cloud consolesAWS / GCP / Azure
Model registryS3 / GCS / HF Hub
Publishing tokenscrates.io / npm
Source controlGitHub / GitLab PAT
CI/CD secretsActions / GitLab CI
Hugging FaceHF_TOKEN
Weights & BiasesWANDB_API_KEY
LLM provider keysOpenAI / Anthropic
Vector DBQdrant / Pinecone
SSH keys~/.ssh/id_*

Rotate cloud and model-registry credentials first: they unlock the models, checkpoints and data themselves. Publishing tokens for crates.io and npm come next, because they let this actor poison your next build.

Browser-saved logins in Chrome, Brave and Edge are the confirmed theft vector. The rest is what a dev or CI endpoint holds. The ordering is blast-radius priority for an AI org, not measured per-victim theft.

Indicators

  • Malicious versions: arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9, proc-macro1 (all versions)
  • Deleted crates: proc-macro-en, aovine, arone, aronenao, tinymember
  • Accounts: droundy (compromised maintainer), dtolney (impersonating dtolnay)
  • Files: /tmp/rust-setup, %TEMP%\rust-setup.ps1, %TEMP%\rust-setup-launch.vbs
  • Network: 23.254.165[.]112:9089 and :443, 23.254.167[.]107:443, hwsrv-798836.hostwindsdns[.]com
  • C2 path: /49890878 (shared with the Mastra campaign)

Sample output

Threat Hunt commands
# Find affected versions anywhere they are pinned
rg -n "arrayref 0.3.10|internment 0.8.7|append-only-vec 0.1.9|proc-macro1" Cargo.lock

# Build-endpoint IoCs
ls -la /tmp/rust-setup 2>/dev/null
grep -R "23.254.165" /var/log 2>/dev/null

Sources

  • RUSTSEC-2026-0260: canonical advisory
  • StepSecurity: build-time chain analysis
  • Wiz: attribution and Rust-environment reach (TODO (deck cites a truncated wiz.io/blog/rust-supply-chain-attack-on-arrayref... URL))
  • BleepingComputer: reporting, 245M downloads (TODO (deck cites a truncated bleepingcomputer.com/news/security/hackers-poison-arrayref... URL))
  • Semgrep: IoCs, SHA-256 payloads, detection rules (TODO (deck cites a truncated semgrep.dev/blog/2026/rust-crates-arrayref... URL))

View the original deck

Related briefings

HIGH · LOCAL AGENT HIJACK

One Local Setting Turned Meta's Muse Into a Mac Backdoor

A user-writable dictation endpoint let code running as the logged-in Mac user redirect Muse's audio, transcript, and session token, then steer the agent through permissions already granted to it.

Read

Full advisory

Download the briefing PDF

The complete advisory deck for this incident, with the attack chain diagram, indicators, and remediation bands in one file.

Optimus Labs · Civilizations

Get the next briefing first

Threat research, disclosures, and practical tips on enterprise Agentic AI attack surface management, directly in you or your agent's inbox.

Subscribe

Ecosystem

NVIDIA Inception ProgramAWS ActivateOpen Secure AI Alliance general memberThe Linux Foundation Silver MemberCarnegie Mellon University