Compromised crates.io Account Publishes Build-Time Malware in Three High-Volume Rust Crates for Under Two Hours

The attack window lasted 86 to 107 minutes per crate before Rust Security Response Team removal. Each release yanked prior versions in the same minute, leaving only the malicious one as the default resolution target. The injected dependency copied proc-macro2 source but replaced its build script with code that reassembled C2 addresses from base64 fragments, installed an unconditional TLS verifier, and dropped platform-specific executables or PowerShell launchers. No CVE was assigned and RustSec records show zero confirmed downloads of the malicious releases.

The incident exposes a persistent supply-chain pattern: account takeover of long-lived maintainers followed by dependency substitution that activates at build time rather than runtime. Similar tactics appeared in the 2018 event-stream npm compromise and the 2023 PyPI colorama incident, yet crates.io still lacks mandatory 2FA or reproducible-build requirements for high-download crates. The 245-million-download aggregate figure cited by the source understates transitive exposure because any project resolving the yanked versions would trigger the payload without calling the crate API.

Official statements emphasize rapid detection and no observed usage, yet the absence of independent download telemetry or signed build attestations leaves that claim unverified. Cargo's job-object escape on Windows and unconditional certificate bypass demonstrate attacker familiarity with both the build system and defender monitoring gaps. Without enforced provenance checks or reproducible builds, the next compromise will again be limited only by the attacker's speed at publishing before takedown.