Rust Attack Reaches Solana Dependency Chain: Systems Compiling 3 Packages At Risk

A coordinated supply chain attack targeting specific versions of three widely used packages in the Rust ecosystem has created a remote code execution risk for developer and CI machines during Cargo builds; the use of arrayref in dependency chains reaching Solana components has expanded the scope of the threat.

According to Wu Blockchain, researchers from SlowMist, Socket, and StepSecurity reported that the attack was embedded into specific versions of the `arrayref`, `internment`, and `append-only-vec` packages used in Rust projects.

The malicious versions included `[email protected]`, `[email protected]`, and `[email protected]`. A typosquatted `proc-macro1` dependency was added to the packages. The build script of this dependency could download and execute a remote payload from the internet during a Cargo build. Consequently, merely compiling the affected package could put developer computers or CI servers at risk. The mechanism could be used for remote code execution, gathering system information, establishing persistence, and executing shell commands.

Solana dependency chains also at risk

It was reported that version 0.3.9 of `arrayref`, stated to be clean, has reached approximately 152 million downloads. The package is also used in dependency chains extending to Solana token, staking, and validator components. However, this does not mean the Solana network or related projects have been compromised; there is no verified breach of any sub-projects.

The Rust security team has removed the malicious versions and locked the maintainer’s account. It was stated that the maintainer’s machine or publishing credentials may have been compromised. Developers are advised to inspect their `Cargo.lock` files and build environments, use exact versions such as `=0.3.9` where necessary, and refresh affected credentials from trusted environments.