# arrayref: a Poisoned Rust Crate Hits the AI Build Endpoint
# Optimus Labs · Civilizations — https://www.optimuslabs.io/research/briefings/arrayref-rust-crate-build-time-rce
# Published: 2026-08-20 | Severity: critical
# Affected: crates.io, RustSec, Wiz, StepSecurity, Semgrep
#
# Machine-readable siblings:
#   STIX 2.1: https://www.optimuslabs.io/research/briefings/arrayref-rust-crate-build-time-rce.stix.json
#   MISP event: https://www.optimuslabs.io/research/briefings/arrayref-rust-crate-build-time-rce.misp.json
#   Markdown: https://www.optimuslabs.io/research/briefings/arrayref-rust-crate-build-time-rce.md

## file
rust-setup.ps1

## ipv4
23.254.165.112
23.254.167.107

## domain
hwsrv-798836.hostwindsdns.com
crates.io

## narrative-indicators
# Malicious versions: arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9, proc-macro1 (all versions)
# Deleted crates: proc-macro-en, aovine, arone, aronenao, tinymember
# Accounts: droundy (compromised maintainer), dtolney (impersonating dtolnay)
# Files: /tmp/rust-setup, %TEMP%\rust-setup.ps1, %TEMP%\rust-setup-launch.vbs
# Network: 23.254.165[.]112:9089 and :443, 23.254.167[.]107:443, hwsrv-798836.hostwindsdns[.]com
# C2 path: /49890878 (shared with the Mastra campaign)
# Advisory: RUSTSEC-2026-0260 (no patched release, downgrade only)