Rust supply chain attack exposes Solana ecosystem components to potential remote code execution

Three widely used Rust packages were briefly hijacked on August 20, 2026, injecting malware into developer builds and putting critical blockchain infrastructure, including Solana’s, in the blast radius. The attack lasted less than two hours. The compromised crates, [email protected], [email protected], and [email protected], were published to the crates.io registry in a tight 23-minute window between 07:15 and 07:38 UTC. Each contained a dependency on a poisoned version of proc-macro1, which quietly activated a build script during Cargo builds. That script downloaded and executed malware on the developer’s machine without touching the original crate source code. What happened, and how fast it moved The Rust Security Response Team moved quickly once the threat was identified. The malicious version of arrayref was live for 86 minutes, internment for 90 minutes, and append-only-vec for 107 minutes before all three were yanked from the registry. The maintainer account believed to be compromised was locked. To put the exposure in context: the previous clean version of arrayref alone, version 0.3.9, had accumulated somewhere between 152 and 245 million lifetime downloads. That’s the kind...