Optimus Labs · CivilizationsAug 20, 2026CRITICAL · SUPPLY CHAIN

arrayref: a Poisoned Rust Crate Hits the AI Build Endpoint

The DPRK crew behind the Mastra AI-framework attack poisoned arrayref so its build script runs a credential stealer during cargo build, on the developer or CI endpoint that builds your AI tooling, not on your inference nodes.

Supply chainCoding agentSCSupply Chain nth Party RiskAIAI Asset Supply Chain SecurityALAgentware Lifecycle SecurityCHCyber Hygiene

Organizations in this briefing

Ccrates.io

RRustSec

WWiz

SStepSecurity

SSemgrep

Key takeaways

4 min read

The DPRK crew behind the Mastra AI-framework attack poisoned arrayref so its build script runs a credential stealer during cargo build, on the developer or CI endpoint that builds your AI tooling, not on your inference nodes.
Blast radius: Every developer laptop and CI runner that compiled arrayref 0.3.10, internment 0.8.7 or append-only-vec 0.1.9, directly or transitively, ran attacker code at compile time. arrayref carries ~245M all-time downloads and Wiz places it in roughly three quarters of Rust environments. The malicious versions were live about 86 minutes and RUSTSEC-2026-0260 states there is no evidence of actual usage. Real downstream reach is GUI (winit, egui, eframe, iced via tiny-skia), crypto/hashing (blake2b_simd, blake2s_simd, older blake3) and blockchain (Ethereum, Solana). No AI/ML framework is a named victim: candle, tokenizers, safetensors and qdrant-client do not depend on arrayref, and pure-Python stacks are not directly hit.
CRITICAL · SUPPLY CHAIN

Blast radius: Every developer laptop and CI runner that compiled arrayref 0.3.10, internment 0.8.7 or append-only-vec 0.1.9, directly or transitively, ran attacker code at compile time. arrayref carries ~245M all-time downloads and Wiz places it in roughly three quarters of Rust environments. The malicious versions were live about 86 minutes and RUSTSEC-2026-0260 states there is no evidence of actual usage. Real downstream reach is GUI (winit, egui, eframe, iced via tiny-skia), crypto/hashing (blake2b_simd, blake2s_simd, older blake3) and blockchain (Ethereum, Solana). No AI/ML framework is a named victim: candle, tokenizers, safetensors and qdrant-client do not depend on arrayref, and pure-Python stacks are not directly hit.
Classifiers: SC: Supply Chain nth Party Risk · AI: AI Asset Supply Chain Security · AL: Agentware Lifecycle Security · CH: Cyber Hygiene

Summary

A compromised maintainer account (droundy) and an impersonation account (dtolney, mimicking dtolnay) published malicious arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 to crates.io. Each added a typosquatted dependency, proc-macro1 (mimicking proc-macro2), whose build.rs downloads and runs a stage-2 implant during compilation. Building an affected project, locally, in CI or through an AI coding agent, runs it. This is not a model backdoor. The payload runs at compile time, so the target is the machine that builds AI tooling, and what the actor wants is that host's credential store.

What happened

01:17 UTC: a fake GitHub account is created. 07:15: malicious arrayref 0.3.10 goes live on crates.io. 07:54: reported to RustSec. 08:03: proc-macro1 deleted. 08:41: arrayref pulled. Total exposure window roughly 86 minutes.
arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 each added the typosquatted dependency proc-macro1. Its build.rs fetches and runs a stage-2 implant during `cargo build`, so compilation alone is execution.
Confirmed payload behavior (Wiz, StepSecurity, BleepingComputer): a cross-platform stealer/backdoor for Linux, Windows and macOS on x86_64 and aarch64. It reads Chrome, Brave and Edge saved logins from their SQLite Login Data databases and collects host credentials.
It persists through Registry Run keys, LaunchAgents or systemd, and beacons to C2 over HTTPS at path /49890878, with a DGA fallback of 10 .com domains every 5 days.
Attribution is strong overlap, not vendor-confirmed here. Wiz reports the C2 path /49890878 matches the Mastra AI-agent-framework campaign that Microsoft attributed to DPRK / Sapphire Sleet, a victim-reported IP appears in Mandiant/Google analysis of UNC1069's axios npm attack, and both campaigns use the Hostwinds 23.254.164.0/23 range.

Why it matters

Every build runs on an endpoint. The stealer runs, persists and beacons from a developer laptop or CI runner, never from an inference node.
AI teams build a lot of Rust: tokenizers, serving and inference layers, checkpoint-hashing crypto, data pipelines, CLI tooling, dashboards. A poisoned transitive crate runs on the machines that hold AI secrets.
A lockfile scan flags the crate. Only the endpoint shows that a build ran it, what it stole, and whether it persisted.
Nobody installs arrayref on purpose. It arrives transitively, which is why a foundational crate with ~245M downloads is a better lever for this actor than any AI framework.
There is no patched release. Remediation is a downgrade, which makes lockfile hygiene and build provenance the durable controls rather than a version bump.

What to do

1Grep every Cargo.lock, CI job and container image for arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9 and any proc-macro1.
2There is no patched release. Pin arrayref at or below 0.3.9, internment 0.8.6, append-only-vec 0.1.8, then rebuild clean.
3Treat any laptop or CI runner that built a malicious version as breached: rotate its credentials, check persistence, reimage.
4Put endpoint detection on build machines, and keep cargo build off inference nodes.

Remediation

Contain now (0-24h)

Grep every Cargo.lock, CI job and container image for arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9 and any proc-macro1 or proc-macro-en.
Hunt the IoCs: /tmp/rust-setup on Unix, %TEMP%\rust-setup.ps1 and %TEMP%\rust-setup-launch.vbs on Windows, egress to 23.254.165[.]112:9089 and :443, secondary 23.254.167[.]107:443, hwsrv-798836.hostwindsdns[.]com, C2 path /49890878.
On build endpoints, watch process lineage: cargo or rustc spawning curl, powershell or wscript, and writes to /tmp/rust-setup.
No patched release exists (RUSTSEC-2026-0260). Downgrade and pin arrayref at or below 0.3.9, internment at or below 0.8.6, append-only-vec at or below 0.1.8, then rebuild clean.

Investigate, assume breach (24-72h)

Rotate cloud and model-registry tokens first (AWS, GCP, Azure, S3, GCS, HF Hub): they unlock models, checkpoints and data.
Then rotate Hugging Face and Weights & Biases keys, crates.io and npm publishing tokens, and code-signing keys, because those enable the next poisoning.
Then rotate GitHub and GitLab PATs, CI/CD secrets, vector-DB and LLM-provider keys, SSH keys, and invalidate browser sessions.
Check persistence (Registry Run keys, LaunchAgents, systemd) and review egress since 07:15 UTC on Aug 20.
Reimage any dev or CI endpoint that built a malicious version. Do not clean in place: this is a full backdoor with persistence.

Harden strategically

Put endpoint detection on build machines: lockfile scanning cannot see execution, persistence or exfiltration, only the endpoint can.
Separate build from runtime so inference nodes never run cargo build, and sandbox build.rs, which executes arbitrary code at compile time.
Scope CI secrets so build jobs cannot reach production model-deploy keys.
Commit Cargo.lock, run cargo-audit and cargo-deny in CI, watch RustSec alongside PyPI and npm, and require build provenance or attestation.

Leaked by association

Entity	Identifier
Cloud consoles	`AWS / GCP / Azure`
Model registry	`S3 / GCS / HF Hub`
Publishing tokens	`crates.io / npm`
Source control	`GitHub / GitLab PAT`
CI/CD secrets	`Actions / GitLab CI`
Hugging Face	`HF_TOKEN`
Weights & Biases	`WANDB_API_KEY`
LLM provider keys	`OpenAI / Anthropic`
Vector DB	`Qdrant / Pinecone`
SSH keys	`~/.ssh/id_*`

Rotate cloud and model-registry credentials first: they unlock the models, checkpoints and data themselves. Publishing tokens for crates.io and npm come next, because they let this actor poison your next build.

Browser-saved logins in Chrome, Brave and Edge are the confirmed theft vector. The rest is what a dev or CI endpoint holds. The ordering is blast-radius priority for an AI org, not measured per-victim theft.

Indicators

Malicious versions: arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9, proc-macro1 (all versions)
Deleted crates: proc-macro-en, aovine, arone, aronenao, tinymember
Accounts: droundy (compromised maintainer), dtolney (impersonating dtolnay)
Files: /tmp/rust-setup, %TEMP%\rust-setup.ps1, %TEMP%\rust-setup-launch.vbs
Network: 23.254.165[.]112:9089 and :443, 23.254.167[.]107:443, hwsrv-798836.hostwindsdns[.]com
C2 path: /49890878 (shared with the Mastra campaign)

Sample output

Threat Hunt commands

# Find affected versions anywhere they are pinned
rg -n "arrayref 0.3.10|internment 0.8.7|append-only-vec 0.1.9|proc-macro1" Cargo.lock

# Build-endpoint IoCs
ls -la /tmp/rust-setup 2>/dev/null
grep -R "23.254.165" /var/log 2>/dev/null

Sources

RUSTSEC-2026-0260: canonical advisory
StepSecurity: build-time chain analysis
Wiz: attribution and Rust-environment reach (TODO (deck cites a truncated wiz.io/blog/rust-supply-chain-attack-on-arrayref... URL))
BleepingComputer: reporting, 245M downloads (TODO (deck cites a truncated bleepingcomputer.com/news/security/hackers-poison-arrayref... URL))
Semgrep: IoCs, SHA-256 payloads, detection rules (TODO (deck cites a truncated semgrep.dev/blog/2026/rust-crates-arrayref... URL))

View the original deck

Related briefings

Sep 14, 2026CRITICAL · SUPPLY CHAIN

AI Agents Flooded RubyGems to Get Code Execution on Its Docs Builder

The target was the registry's build service, not the people who use it. Publishing a gem triggered code execution on RubyDoc.info without anyone running gem install.

Read

Sep 1, 2026CRITICAL · CVSS 9.0 (no CVE)

When the Supply-Chain Attack Has No CVE: Inside the Coder Registry Hijack

Coder's own delivery infrastructure was hijacked to serve credential-stealing modules from the real registry.coder.com. No CVE, no poisoned package, nothing for a scanner to match.

Read

Aug 17, 2026HIGH · ROGUE AI