MAL-2026-14336

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/crates.io/arrayref/MAL-2026-14336.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-14336
Published
2026-08-20T00:00:00Z
Modified
2026-08-21T01:35:08.932025040Z
Summary
Malicious code in arrayref (crates.io)
Details

arrayref 0.3.10 was published to crates.io from a maintainer account (droundy) that appears to be compromised. Unlike every prior release, 0.3.10 declares a dependency on the malicious crate proc-macro1. The arrayref source itself is unchanged genuine macro code, but Cargo compiles the declared dependency, so building any project that resolves arrayref 0.3.10 pulls in and builds proc-macro1, whose build script downloads and executes an architecture-specific remote binary at build time from https://23.254.165.112:9089/ and passes 23.254.165.112:443 as a command-and-control address. Part of a coordinated crates.io campaign on 2026-08-20 that also trojanized internment and append-only-vec. The malicious release has been removed from crates.io; releases 0.3.9 and earlier are unaffected.

Database specific 
{
    "iocs": {
        "ips": [
            "23.254.165.112"
        ],
        "urls": [
            "https://23.254.165.112:9089/rust-crate_0.1.0",
            "https://23.254.165.112:9089/rust-crate_0.2.0",
            "https://23.254.165.112:9089/rust-crate_0.3.0",
            "https://23.254.165.112:9089/rust-crate_0.4.0"
        ],
        "files": [
            {
                "paths": [
                    "/tmp/rust-setup"
                ],
                "note": "Unix second-stage binary, executed with 23.254.165.112:443 as argv[1]",
                "source": "DROPPED"
            },
            {
                "paths": [
                    "%TEMP%\\rust-setup.ps1"
                ],
                "note": "Windows PowerShell second-stage",
                "source": "DROPPED"
            },
            {
                "paths": [
                    "%TEMP%\\rust-setup-launch.vbs"
                ],
                "source": "DROPPED",
                "note": "Windows VBScript launcher for the PowerShell stage"
            }
        ]
    }
}
References
Credits

Affected packages

crates.io / arrayref

Package

Name
arrayref
View open source insights on deps.dev
Purl
pkg:cargo/arrayref

Affected ranges

Affected versions

0.*
0.3.10

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/crates.io/arrayref/MAL-2026-14336.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]