arrayref: a Poisoned Rust Crate Hits the AI Build Endpoint

What happened

• 01:17 UTC: a fake GitHub account is created. 07:15: malicious arrayref 0.3.10 goes live on crates.io. 07:54: reported to RustSec. 08:03: proc-macro1 deleted. 08:41: arrayref pulled. Total exposure window roughly 86 minutes.
• arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 each added the typosquatted dependency proc-macro1. Its build.rs fetches and runs a stage-2 implant during `cargo build`, so compilation alone is execution.
• Confirmed payload behavior (Wiz, StepSecurity, BleepingComputer): a cross-platform stealer/backdoor for Linux, Windows and macOS on x86_64 and aarch64. It reads Chrome, Brave and Edge saved logins from their SQLite Login Data databases and collects host credentials.
• It persists through Registry Run keys, LaunchAgents or systemd, and beacons to C2 over HTTPS at path /49890878, with a DGA fallback of 10 .com domains every 5 days.
• Attribution is strong overlap, not vendor-confirmed here. Wiz reports the C2 path /49890878 matches the Mastra AI-agent-framework campaign that Microsoft attributed to DPRK / Sapphire Sleet, a victim-reported IP appears in Mandiant/Google analysis of UNC1069's axios npm attack, and both campaigns use the Hostwinds 23.254.164.0/23 range.

Why it matters

• Every build runs on an endpoint. The stealer executes, persists and beacons from a developer laptop or CI runner, never from an inference node, so the exposure is an endpoint problem rather than a model-serving one.
• AI teams build a lot of Rust: tokenizers, serving and inference layers, checkpoint-hashing crypto, data-pipeline and CLI tooling, dashboards. A poisoned transitive crate therefore detonates on exactly the machines that hold AI secrets.
• The endpoint blind spot: a lockfile scan flags the crate. Only the endpoint shows that a build actually ran it, what it stole, and whether it persisted.
• Nobody installs arrayref on purpose. It arrives transitively, which is why a foundational crate with ~245M downloads is a better lever for this actor than any AI framework.
• There is no patched release. Remediation is a downgrade, which makes lockfile hygiene and build provenance the durable controls rather than a version bump.

What to do

1. 1Grep every Cargo.lock, CI job and container image for arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9 and any proc-macro1.
2. 2There is no patched release. Downgrade and pin arrayref at or below 0.3.9, internment at or below 0.8.6, append-only-vec at or below 0.1.8, then rebuild clean.
3. 3Treat any dev laptop or CI runner that built a malicious version as breached: rotate its credentials, check persistence, and reimage rather than clean in place.
4. 4Separate build from runtime so inference nodes never run cargo build, sandbox build.rs, scope CI tokens, and run cargo-audit and cargo-deny in CI.
5. 5Put endpoint detection on build machines. Dev laptops and CI runners are production endpoints, and lockfile scanning cannot see execution, persistence or exfiltration.

Remediation

Leaked by association

Rotate cloud and model-registry credentials first: they unlock the models, checkpoints and data themselves. Publishing tokens for crates.io and npm come next, because they let this actor poison your next build.

Browser-saved logins in Chrome, Brave and Edge are the confirmed theft vector. The rest is what a dev or CI endpoint holds. The ordering is blast-radius priority for an AI org, not measured per-victim theft.

Indicators

Sample output

# Find affected versions anywhere they are pinned
rg -n "arrayref 0.3.10|internment 0.8.7|append-only-vec 0.1.9|proc-macro1" Cargo.lock

# Build-endpoint IoCs
ls -la /tmp/rust-setup 2>/dev/null
grep -R "23.254.165" /var/log 2>/dev/null

Sources