{
  "Event": {
    "uuid": "8abe23fc-0101-403b-8744-0ec398bbf543",
    "info": "arrayref: a Poisoned Rust Crate Hits the AI Build Endpoint — Optimus Labs · Civilizations",
    "date": "2026-08-20",
    "threat_level_id": "1",
    "analysis": "2",
    "published": true,
    "Orgc": {
      "name": "Optimus Labs · Civilizations"
    },
    "Tag": [
      {
        "name": "optimus:briefing=\"arrayref-rust-crate-build-time-rce\""
      },
      {
        "name": "optimus:severity=\"critical\""
      },
      {
        "name": "optimus:type=\"supply-chain\""
      },
      {
        "name": "optimus:type=\"coding-agent\""
      },
      {
        "name": "optimus:category=\"SC\""
      },
      {
        "name": "optimus:category=\"AI\""
      },
      {
        "name": "optimus:category=\"AL\""
      },
      {
        "name": "optimus:category=\"CH\""
      },
      {
        "name": "type:OSINT"
      }
    ],
    "Attribute": [
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://www.optimuslabs.io/research/briefings/arrayref-rust-crate-build-time-rce",
        "comment": "Optimus Labs briefing"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://rustsec.org/advisories/RUSTSEC-2026-0260.html",
        "comment": "RUSTSEC-2026-0260 — canonical advisory"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack",
        "comment": "StepSecurity — build-time chain analysis"
      },
      {
        "type": "filename",
        "category": "Payload delivery",
        "to_ids": false,
        "value": "rust-setup.ps1",
        "comment": "Files: /tmp/rust-setup, %TEMP%\\rust-setup.ps1, %TEMP%\\rust-setup-launch.vbs"
      },
      {
        "type": "ip-dst",
        "category": "Network activity",
        "to_ids": true,
        "value": "23.254.165.112",
        "comment": "Network: 23.254.165[.]112:9089 and :443, 23.254.167[.]107:443, hwsrv-798836.hostwindsdns[.]com"
      },
      {
        "type": "ip-dst",
        "category": "Network activity",
        "to_ids": true,
        "value": "23.254.167.107",
        "comment": "Network: 23.254.165[.]112:9089 and :443, 23.254.167[.]107:443, hwsrv-798836.hostwindsdns[.]com"
      },
      {
        "type": "domain",
        "category": "Network activity",
        "to_ids": true,
        "value": "hwsrv-798836.hostwindsdns.com",
        "comment": "Network: 23.254.165[.]112:9089 and :443, 23.254.167[.]107:443, hwsrv-798836.hostwindsdns[.]com"
      },
      {
        "type": "domain",
        "category": "Network activity",
        "to_ids": true,
        "value": "crates.io",
        "comment": "Publishing tokens: crates.io / npm"
      }
    ]
  }
}