Supply Chain Attack Hits Rust’s arrayref Ecosystem; Malicious Crates Pulled in Under Two Hours
A malicious payload slipped into the Rust ecosystem on August 20, 2026, riding inside the widely used arrayref crate. The Rust Security Response Team caught the compromise, verified the build-script payload, and yanked the affected versions within roughly two hours of the initial report. If your CI systems or local workstation pulled arrayref@0.3.10 during that window, it is time to check your build cache.
The compromised account belongs to Andrew Gallant, known to the Rust community as BurntSushi. He created ripgrep, which sits at over 67,000 GitHub stars, and maintains several heavily used crates, including internment and append-only-vec. The security team made it clear in their advisory that they do not believe Gallant acted maliciously. His machine or credentials were almost certainly compromised.
The attack played out between 07:15 and 09:25 UTC. First came arrayref@0.3.10, followed by fresh publishes of internment@0.8.7 and append-only-vec@0.1.9. Each new version quietly pulled in a dependency that did not exist before. Names like proc-macro1, proc-macro-en, aovine, arone, and tinymember appeared in the dependency tree. Every single one shipped a build.rs script that reached out to an external server and downloaded a payload during compilation. Build scripts run with full system access before any sandboxing or analysis kicks in, which makes them the classic vector for this kind of sabotage.
What made the compromise stickier was the operational discipline on the attacker’s end. They yanked legitimate recent versions of arrayref to cover their tracks, which forced the security team to unyank them so users could pin to known-good versions. That level of noise reduction is the kind of thing you usually see in state-sponsored campaigns, not in a typical credential-stuffing incident. The junk crates the attacker pushed were all swept up and deleted alongside the primary payloads. Gallant’s crates.io account was locked as a precaution.
Keep in mind that the damage window was short, but CI/CD pipelines resolve dependencies on a fresh cache by default. A single overnight build that happened to pull that version would have executed the build script without raising a single alarm. The payload itself was not publicly detailed in the advisory, but the presence of an outbound network call during compilation is usually enough to flag a malicious build.
What You Should Do Now
Pin arrayref to anything below 0.3.10. Check your local Cargo cache and any CI logs for builds that ran between 07:15 and 09:25 UTC on August 20. If you publish crates yourself, enable two-factor authentication on crates.io and audit your authorized tokens. The advisory includes exact shell commands to scan your cache for the malicious crate files, along with the full list of affected versions.
The incident fits a pattern that dates back to the event-stream fiasco in 2018 and repeats in roughly three year cycles. ua-parser-js took the same route in 2021, and the XZ Utils backdoor last year proved you cannot assume the worst case is off the table. Rust’s trust model leans heavily on community audit, which works beautifully until someone compromises a maintainer who has already earned your trust. That is a hard lesson, and it is one the ecosystem will likely formalize with stricter publishing gatechecks in the months ahead.
Head here to read the official advisory and browse the Rust Security Response Team’s full breakdown. The immediate threat is contained. Now it is a matter of cleaning up caches and tightening account hygiene across the board.
