Rust Supply Chain Attack Hits Solana-Related Build Pipelines

The Solana-related build pipelines were hit by a supply chain attack using Rust's package manager Cargo. The malicious packages, arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9, introduced a typosquatted proc-macro1 dependency that downloaded and executed a remote payload during the build process.

The security researchers from SlowMist, Socket, and StepSecurity identified the tainted packages and notified Rust's security team, who removed the malicious releases and locked the maintainer account.

The attack did not require a downstream vulnerability, but rather just pulling in the tainted dependency and running a Cargo build. This shifted the risk from application exploitability to the developer workstation and continuous integration environment.

The presence of those crates in a project graph does not mean downstream projects were compromised, but it does mean many teams had to audit their lockfiles and build logs urgently.