Act
active
arrayref Rust crate poisoned with build-time infostealer malware
- Engineer — Act: Supply-chain compromise of a widely used Rust crate that executes malware at build time matches Act criteria even without KEV/EPSS signals. Audit your Cargo.lock for arrayref, identify any builds that ran against the compromised versions, rotate secrets accessible from affected build environments, and pin to a verified clean version or remove the dependency.
- SOC/IR — Act: Build-time execution means any developer or CI runner that compiled code with the poisoned crate may be implanted with an infostealer — assume breach on those systems. Hunt for infostealer IOCs (check the BleepingComputer write-up for specifics) on developer workstations and CI/CD runners that use Rust, prioritizing the window since the account compromise occurred.
- Leader — Act: A compromised popular Rust crate that stole credentials from developer machines is a potential breach event if your org uses Rust. Confirm whether arrayref appears in any internal Cargo.lock files, determine the affected build window, and have your team assess whether CI secrets or developer credentials were exposed before briefing leadership.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.