Rust Crate 'arrayref' Poisoned With Build-Time Malware in Major Supply-Chain Attack

Hackers compromise the maintainer account of the widely used Rust crate arrayref to push infostealer malware. The supply-chain attack poisoned arrayref, a foundational library with over 245 million lifetime downloads used in Ethereum and Solana components, leaving developers exposed for nearly 1.5 hours. Attackers injected a typosquatted dependency called proc-macro1 that automatically executes a script during compilation to fetch a payload matching the host operating system. The malware gains persistence across Windows, macOS, and Linux machines to extract saved credentials directly from Google Chrome, Brave, and Edge browser databases. Cloud security firm Wiz connected the attack's infrastructure to recent North Korean supply-chain campaigns known as Mastra and axios. It doesn't matter how secure your production environment is when a single compromised maintainer account can silently execute arbitrary code during a routine developer build.