Rust Supply Chain Compromise Exposes Solana Build Pipelines

Rust Supply Chain Attack Compromises Solana-Adjacent Build Pipelines

The Rust security team has removed malicious releases of three widely-used crates, arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9, after security researchers from SlowMist, Socket, and StepSecurity identified a tainted package that introduced a typosquatted proc-macro1 dependency.

The attack did not require a downstream vulnerability, but simply pulling in the tainted dependency and running a Cargo build was enough to trigger a remote payload, which executed during the build phase before code review. This shifted the risk from application exploitability to the developer workstation and continuous integration environment, where secrets, signing keys, and infrastructure access tend to live.

The presence of these crates in a project graph does not mean downstream projects were compromised, but it does mean many teams had to audit their lockfiles and build logs urgently, since a malicious version can enter a project through transitive dependencies without a direct update.