Rust Supply Chain Attack Exposes Solana-Adjacent Projects to Remote Payload Threat

A critical security vulnerability has been discovered in the Rust supply chain, affecting Solana-adjacent projects. The issue arises from malicious releases of arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9 crates, which introduced a typosquatted proc-macro1 dependency.

During Cargo builds, this dependency's build script downloaded and executed a remote payload, exposing developer workstations, CI runners, secrets, and signing keys to potential attacks. The Rust security team has removed the malicious releases and locked the maintainer account, suggesting a likely compromise of the maintainer's machine or publishing credentials.

Solana-adjacent projects, including wallets, validators, indexers, and DeFi interfaces, must urgently audit Cargo.lock files, refresh cached dependencies, and inspect CI for outbound connections. The vulnerability does not require a downstream application exploitability but rather triggers a remote payload simply by pulling in the tainted dependency and running a Cargo build.