Attackers compromised the maintainer account of the Rust crate arrayref and introduced malware in version 0.3.10, alongside poisoned versions of append-only-vec 0.1.9 and internment 0.8.7. The malware was delivered via a typosquatted dependency named proc-macro1, impersonating proc-macro2, which executed a build script during compilation. This script reconstructed its payload from base64 fragments and deployed OS-specific infostealer malware targeting Linux, Windows, and macOS systems. The malware exfiltrated credentials from browsers, established persistence via system mechanisms (Registry Run key, LaunchAgent, systemd), and communicated with a command-and-control server. The attack lasted approximately 1.5 hours before detection and removal of malicious packages from crates.io. The infrastructure overlaps with known DPRK supply-chain attacks. Developers using affected versions should assume compromise and rotate credentials and secrets.

The attack potentially compromised developer systems compiling the affected Rust crates, leading to credential theft from browsers and persistent malware presence. Given arrayref's extensive use in cryptography, graphics, blockchain, and major Rust projects, the impact is significant. The attacker gained access to sensitive credentials and could maintain persistence, increasing risk of further compromise. The supply-chain nature means downstream projects and users depending on these crates may also be affected if they used the malicious versions during the exposure window.

The malicious versions (arrayref 0.3.10, append-only-vec 0.1.9, internment 0.8.7) were removed from crates.io shortly after discovery. Developers who installed these versions during the exposure window should assume compromise. Recommended actions include searching Cargo.lock files for these versions, checking for dropped malicious files, reviewing network traffic to the identified command-and-control IP and ports, rotating all credentials, CI tokens, signing keys, and secrets, and rebuilding environments from trusted backups. Projects should pin dependencies to known safe versions until the maintainer situation is resolved. No official patch is indicated; remediation relies on removal and credential rotation.