Malicious code in arone (crates.io)
arone is a malicious Rust crate published to crates.io on 2026-08-20 as part of a coordinated build-time payload campaign. The crate's build script downloads and executes a remote binary from an attacker-controlled server. All versions have been removed from crates.io.
- Disclosed
- Last updated
- Blast radius
- All users who built the arone crate from crates.io
- Ecosystems
- Attack vectors
- Affected entities
- aroneMalicious crate published to crates.io
arone was a malicious crate published to crates.io on 2026-08-20 as part of a coordinated supply chain attack campaign. The crate was designed to be used as an attacker-controlled dependency carrying a build-script payload.
When built, the crate's build script downloads and executes a remote binary from https://23.254.165.112:9089/, with 23.254.165.112:443 serving as the command and control server. This represents a direct code execution vulnerability at build time for any project that included arone as a dependency.
The arone crate was part of a broader coordinated campaign that also trojanized arrayref, internment, and append-only-vec, and published proc-macro1 as a typosquat of proc-macro2. All versions of arone have been removed from crates.io in response to the discovery.
The incident was identified and credited to the OpenSSF's malicious-packages project.
Indicators of compromise
- Packages
- arone
- IPs
- 23.254.165.112
Remediation
- Remove arone from all project dependencies immediately
- Audit build logs and system activity from any builds that included arone
- Rotate any credentials or secrets that may have been exposed on affected build systems
- Review and update dependencies to ensure no other malicious packages from the coordinated campaign are present (arrayref, internment, append-only-vec, proc-macro1)
- Implement dependency scanning and verification in CI/CD pipelines to detect malicious packages
Sources
- GitHub Advisory GHSA-7h2v-6jmm-f43m · GitHub Advisory Database
Cite this entry
"Malicious code in arone (crates.io)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 20, 2026; last updated August 21, 2026. https://supplychainattack.org/incident/malicious-code-in-arone-crates-io-1bcscw
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in tinymember (crates.io)
tinymember is a malicious Rust crate published to crates.io on 2026-08-20 as part of a coordinated campaign. The crate contained a build-script payload that downloads and executes a remote binary during compilation.
CargoCompromised packageBuild-system compromise - resolvedcritical
Malicious code in aovine (crates.io)
aovine is a malicious Rust crate published to crates.io on 2026-08-20 as part of a coordinated build-time payload campaign. The crate's build script downloads and executes a remote binary from an attacker-controlled server. All versions have been removed from crates.io.
CargoCompromised packageBuild-system compromise - resolvedcritical
Malicious code in aronenao (crates.io)
aronenao is a malicious Rust crate published to crates.io on 2026-08-20 as part of a coordinated campaign that also trojanized arrayref, internment, and append-only-vec. The crate contained a build-script payload that downloads and executes a remote binary from 23.254.165.112:9089 with command and control at 23.254.165.112:443. All versions have been removed from crates.io.
CargoCompromised packageBuild-system compromise - containedhigh
M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions
M-Red-Team compromised AsyncAPI npm packages via GitHub Actions, injecting malicious code into the supply chain. The attack leveraged build system access to distribute compromised packages to downstream consumers.
M Red TeamnpmOtherCompromised packageBuild-system compromise