Attack on Rust software packages hits Solana ecosystem

Security researchers have discovered a coordinated supply chain attack affecting three widely used Rust software packages: arrayref@0.3.10, internment@0.8.7 and append-only-vec@0.1.9. Through a fake package named proc-macro1, malware was automatically downloaded and executed during compilation on developers’ systems and in automated build environments. Because arrayref is also used in components within the Solana ecosystem, the attack has a wide reach, although that does not mean Solana projects themselves have been compromised.

In short:

• Three legitimate Rust packages have been compromised via a malicious fake package that executes malware while building software.
• The attack also affects components used in the Solana ecosystem, but downstream projects are not necessarily affected.
• The Rust security team has removed the malicious versions and blocked the maintainer’s account.

Fake package executed code during compilation

The attackers used typosquatting: they published a package called proc-macro1, which closely resembles the widely used proc-macro2. This fake package was added as a dependency to the three compromised packages. As soon as a developer or an automated system compiled one of those packages, an external script was automatically fetched and executed.

According to security firms SlowMist, Socket and StepSecurity, which jointly reported the attack, the malware could cause damage in various ways: execute remote code, profile systems, set up persistence, collect browser data and execute additional commands.

Wide reach due to popularity of arrayref

The arrayref package is deeply embedded in the Rust ecosystem. The previous, clean version v0.3.9 has an estimated 152 million downloads. The package also appears in dependency chains of popular Rust GUI frameworks and in components used in Solana tokens, staking and validators.

SlowMist warns that this does not mean those projects or systems have actually been compromised. Exposure depends on whether the affected versions were actually compiled.

An additional risk lies in the way dependencies are recorded. Anyone who specifies arrayref = “0.3.9” without exact pinning may still pull in version 0.3.10 on a fresh install or update. Researchers advise using the exact notation arrayref = “=0.3.9” and checking the actually loaded version in the Cargo.lock file.

Security team intervenes, developers must act

The Rust security team has since removed the malicious package versions from the package repository and blocked the maintainer’s account. The likely cause is that the maintainer’s machine or publication credentials were compromised.

Developers who have used the affected versions are advised to check their build environments, refresh any potentially exposed credentials and rebuild affected systems from a trusted environment. More technical details about the attack can be found in the Rust Security Advisory Database and in the MistEye threat report.