Arrayref maintainer account hit by network compromise
Incident
Summary
Hide ▲
Show ▼
The arrayref maintainer account was compromised, and malicious crate releases on crates.io executed during compilation on developers’ systems, creating a supply-chain intrusion risk. The same account also poisoned append-only-vec and internment within a 23-minute window, widening exposure across widely used Rust packages. The fake dependency proc-macro1 used a `build.rs` script and platform-specific payloads to run on Linux, Windows, and macOS systems. The payload was built to collect host data and browser credentials, making the compromise a direct theft and persistence risk for developers.
Related Happenings
Proc-macro1 malicious crate payload
Malware Activity
H score29
First: 20.08.2026 20:53
Last: 20.08.2026 20:53
Sources 1
How related:
According to the researchers, a script in proc-macro1, named ‘build.rs,’ is automatically executed during compilation, reconstructing its infrastructure from base64-encoded fragments and selecting a payload that matches the host OS (Linux x86-64, Windows x86-64, macOS x86-64, and macOS ARM64).
About this happening:
A proc-macro1 typosquatted dependency executed a build-time payload during compilation, creating a credential-stealing risk for developers on Linux, Windows, and *...
Proc-macro1 malicious crate payload
Malware ActivityHow related: According to the researchers, a script in proc-macro1, named ‘build.rs,’ is automatically executed during compilation, reconstructing its infrastructure from base64-encoded fragments and selecting a payload that matches the host OS (Linux x86-64, Windows x86-64, macOS x86-64, and macOS ARM64).
About this happening: A proc-macro1 typosquatted dependency executed a build-time payload during compilation, creating a credential-stealing risk for developers on Linux, Windows, and *...
Malicious npm packages delivering a cross-platform RAT to Alibaba developer tools users
Malware Activity
H score37
First: 03.08.2026 21:43
Last: 03.08.2026 21:43
Sources 1
About this happening:
Researchers uncovered 18 malicious npm packages that deliver a cross-platform RAT through a layered dependency tree, putting Alibaba developer tool users in Chinese-...
Malicious npm packages delivering a cross-platform RAT to Alibaba developer tools users
Malware ActivityAbout this happening: Researchers uncovered 18 malicious npm packages that deliver a cross-platform RAT through a layered dependency tree, putting Alibaba developer tool users in Chinese-...
AsyncAPI malicious npm package supply-chain malware
Malware Activity
H score21
First: 15.07.2026 18:37
Last: 15.07.2026 18:37
Sources 1
About this happening:
Malicious AsyncAPI npm releases pushed a remote access trojan and info-stealing payload into packages with more than 2.25 million weekly downloads, putting downstr...
AsyncAPI malicious npm package supply-chain malware
Malware ActivityAbout this happening: Malicious AsyncAPI npm releases pushed a remote access trojan and info-stealing payload into packages with more than 2.25 million weekly downloads, putting downstr...
Compromised @asyncapi npm packages distributing the Miasma loader
Malware Activity
H score29
First: 15.07.2026 12:16
Last: 15.07.2026 12:16
Sources 1
About this happening:
Four compromised @asyncapi npm packages now deliver a multi-stage botnet loader when imported, exposing consumers to Miasma payloads during normal Node.js module load....
Compromised @asyncapi npm packages distributing the Miasma loader
Malware ActivityAbout this happening: Four compromised @asyncapi npm packages now deliver a multi-stage botnet loader when imported, exposing consumers to Miasma payloads during normal Node.js module load....
Jscrambler 8.14.0 malicious preinstall infostealer release
Malware Activity
H score9
First: 11.07.2026 20:59
Last: 11.07.2026 20:59
Sources 1
About this happening:
The jscrambler 8.14.0 npm release now ships a malicious preinstall hook that runs a Rust infostealer during install, putting developer and CI secrets at risk on ...
Jscrambler 8.14.0 malicious preinstall infostealer release
Malware ActivityAbout this happening: The jscrambler 8.14.0 npm release now ships a malicious preinstall hook that runs a Rust infostealer during install, putting developer and CI secrets at risk on ...
Timeline
-
20.08.2026 20:53 2 articles · 1h ago
Arrayref maintainer account hit by network compromise
Initial DisclosureAn attacker first abused the arrayref maintainer account to publish a malicious release on crates.io at 01:55 UTC. The same operation quickly expanded to append-only-vec and internment, creating a short but dangerous supply-chain exposure window.
Show sources
- Hackers poison arrayref Rust crate to push infostealer malware — www.bleepingcomputer.com — 20.08.2026 20:53
- Hackers poison arrayref Rust crate to push infostealer malware — www.bleepingcomputer.com — 20.08.2026 20:53