Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
A Rust supply chain attack has been discovered, with build-time malware embedded in crates that have accumulated 245 million downloads. The Hacker News reported the incident on August 20, 2026. The malware is designed to execute during the build process, meaning that any developer or organization that compiles these crates could be affected. The exact crates involved were not named in the source, but the high download count suggests significant usage across the Rust ecosystem. The attack highlights the ongoing risk of malicious code in open-source package registries, where popular packages can serve as vectors for widespread compromise. The source does not specify the nature of the malware's payload or the specific impact on affected systems, but the build-time execution suggests it could tamper with build outputs or exfiltrate sensitive data. This incident underscores the importance of supply chain security for developers relying on third-party dependencies.
Build-time malware in widely downloaded crates can compromise any project that uses them.