North Korea-Linked Attackers Poison Rust Crates With 245 Million Downloads

An attacker used a legitimate maintainer's crates.io account to publish malicious versions of three widely-used Rust crates — arrayref, internment, and append-only-vec — on August 20, 2026. A newly added dependency, proc-macro1, was enough to turn a routine `cargo build` into a silent credential theft operation.

The Scale Makes This Different From a Typical Poisoned Package

• arrayref alone has 245,385,500 all-time downloads and 53.9 million in the 90 days before the attack, with 403 distinct crates depending on it directly
• Combined, the three poisoned crates are present in roughly three-quarters of environments where Rust runs — this isn't a niche package, it's foundational infrastructure
• Because the malicious code sat in the dependency's build script, simply building a project that resolved it was sufficient to run the payload — no explicit "install and run" step required, unlike some npm-style attacks

Fast Takedown, Real Attribution

The malicious versions were all removed within 86 to 107 minutes of publication — a genuinely fast response. Security researchers traced the command-and-control infrastructure back to a North Korean state-backed group already known for identical attacks on npm; the payloads beacon to the same C2 request path used in a comparable Mastra campaign, and a victim-reported C2 in this incident overlaps with Google threat intelligence covering the same actor's separate axios campaign.