Reported by 2 outlets

Timeline

1. update from cyberpress.org

   Compromised Rust Crate onering Steals Source Code During Application Builds

   cyberpress.org · 53d ago · August 21st, 2026

   A major software supply chain attack has struck the Rust ecosystem after threat actors hijacked widely used crates and embedded a malicious build-time dependency that can steal source code, browser credentials, and cryptocurrency wallet data during application compilation. The incident affected arrayref version 0.3.10, append-only-vec version 0.1.9, and internment version 0.8.7. Together, the packages have accumulated hundreds of millions of downloads, making the campaign one of the largest known Rust crate compromises in terms of potential downstream exposure. Compromised Rust Crate onering Steals Source Code Researchers at Aikido Security initially identified a suspicious new crate named proc-macro1 . The package impersonated proc-macro2 , a heavily used Rust dependency, by copying its description and documentation. Its similarity to the legitimate package was intended to lower suspicion among developers and automated dependency-review processes. Within approximately one hour of the typosquat’s publication, the compromised arrayref and append-only-vec releases added proc-macro1 version 1.0.107 as a dependency. The injection reportedly consisted of a single line in each crate manifest, leaving the visible application source code unchanged. That detail significantly increased the attack’s stealth. Developers reviewing the Rust code of the affected packages would have seen legitimate-looking content, while the malicious behavior was concealed in proc-macro1 ’s build.rs file. C

2. update from gbhackers.com

   Compromised Rust Crate With 18,000+ Downloads Steals Source Code During Builds

   gbhackers.com · 53d ago · August 21st, 2026

   A malicious update to the Rust crate called onering has been discovered, which exfiltrates source code changes from developers’ machines during the build process. The onering crate, designed as a high-throughput synchronous queue and channels library, has garnered over 18,000 […] The post Compromised Rust Crate With 18,000+ Downloads Steals Source Code During Builds appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .