Three widely used Rust packages were briefly hijacked on August 20, 2026, injecting malware into developer builds and putting critical blockchain infrastructure, including Solana’s, in the blast radius. The attack lasted less than two hours.
The compromised crates, [email protected], [email protected], and [email protected], were published to the crates.io registry in a tight 23-minute window between 07:15 and 07:38 UTC. Each contained a dependency on a poisoned version of proc-macro1, which quietly activated a build script during Cargo builds. That script downloaded and executed malware on the developer’s machine without touching the original crate source code.
What happened, and how fast it moved
The Rust Security Response Team moved quickly once the threat was identified. The malicious version of arrayref was live for 86 minutes, internment for 90 minutes, and append-only-vec for 107 minutes before all three were yanked from the registry. The maintainer account believed to be compromised was locked.
To put the exposure in context: the previous clean version of arrayref alone, version 0.3.9, had accumulated somewhere between 152 and 245 million lifetime downloads. That’s the kind of package that sits deep in dependency trees across thousands of projects, often pulled in transitively without developers ever consciously choosing it.
