Malicious code in aovine (crates.io)
aovine is a malicious Rust crate published to crates.io on 2026-08-20 as part of a coordinated build-time payload campaign. The crate's build script downloads and executes a remote binary from an attacker-controlled server. All versions have been removed from crates.io.
- Disclosed
- Last updated
- Blast radius
- All users who built the aovine crate from crates.io
- Ecosystems
- Attack vectors
- Affected entities
- aovineMalicious crate published to crates.io
aovine was a malicious crate published to crates.io on 2026-08-20 as part of a coordinated supply chain attack campaign. The crate was designed to be used as an attacker-controlled dependency carrying a build-script payload.
When built, the crate's build script downloads and executes a remote binary from https://23.254.165.112:9089/, with 23.254.165.112:443 serving as the command and control server. This represents a critical build-time compromise vector.
The attack was part of a broader coordinated campaign that also trojanized the crates arrayref, internment, and append-only-vec, and published proc-macro1 as a typosquat of proc-macro2. All versions of aovine have been removed from crates.io.
The incident was identified and credited to the OpenSSF's malicious-packages project.
Indicators of compromise
- Packages
- aovine
- IPs
- 23.254.165.112
Remediation
- Remove aovine from all dependencies and lock files
- Audit build logs and system activity from any builds that included aovine
- Revoke any credentials or secrets that may have been exposed during builds
- Monitor systems that built aovine for signs of compromise or unauthorized access
- Review and update dependencies to use only legitimate, verified packages from crates.io
Sources
- GitHub Advisory GHSA-r47g-vj55-h745 · GitHub Advisory Database
Cite this entry
"Malicious code in aovine (crates.io)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 20, 2026; last updated August 21, 2026. https://supplychainattack.org/incident/malicious-code-in-aovine-crates-io-1mdxe2
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in arone (crates.io)
arone is a malicious Rust crate published to crates.io on 2026-08-20 as part of a coordinated build-time payload campaign. The crate's build script downloads and executes a remote binary from an attacker-controlled server. All versions have been removed from crates.io.
CargoCompromised packageBuild-system compromise - resolvedcritical
Malicious code in tinymember (crates.io)
tinymember is a malicious Rust crate published to crates.io on 2026-08-20 as part of a coordinated campaign. The crate contained a build-script payload that downloads and executes a remote binary during compilation.
CargoCompromised packageBuild-system compromise - resolvedcritical
Malicious code in aronenao (crates.io)
aronenao is a malicious Rust crate published to crates.io on 2026-08-20 as part of a coordinated campaign that also trojanized arrayref, internment, and append-only-vec. The crate contained a build-script payload that downloads and executes a remote binary from 23.254.165.112:9089 with command and control at 23.254.165.112:443. All versions have been removed from crates.io.
CargoCompromised packageBuild-system compromise - containedhigh
M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions
M-Red-Team compromised AsyncAPI npm packages via GitHub Actions, injecting malicious code into the supply chain. The attack leveraged build system access to distribute compromised packages to downstream consumers.
M Red TeamnpmOtherCompromised packageBuild-system compromise