Rust Supply Chain Attack Exposes Solana-Adjacent Build Pipelines Vulnerability

Rust Supply Chain Attack Exposes Solana-Adjacent Build Pipelines

A recent supply chain attack on Rust has compromised several build pipelines, particularly those associated with Solana. The malicious releases of arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9 introduced a typosquatted proc-macro1 dependency that downloaded and executed a remote payload during Cargo builds.

The attack did not require a downstream vulnerability, but rather the tainted dependency could trigger a remote payload simply by being pulled in and running a Cargo build. This shifted the risk from application exploitability to the developer workstation and continuous integration environment.

The security team removed the malicious releases and locked the maintainer account, pointing to a likely compromise of the maintainer's machine or publishing credentials. The attack surface was not a one-off technical flaw in crate code but an account-level breach inside the package supply chain itself.