Malicious code in aronenao (crates.io)
aronenao is a malicious Rust crate published to crates.io on 2026-08-20 as part of a coordinated campaign that also trojanized arrayref, internment, and append-only-vec. The crate contained a build-script payload that downloads and executes a remote binary from 23.254.165.112:9089 with command and control at 23.254.165.112:443. All versions have been removed from crates.io.
- Disclosed
- Last updated
- Blast radius
- All users who built the aronenao crate during the window it was available on crates.io
- Ecosystems
- Attack vectors
- Affected entities
- aronenaoMalicious crate published to crates.io; all versions removed
aronenao was a malicious crate published to crates.io on 2026-08-20 as part of a coordinated build-time payload campaign. The crate was used as an attacker-controlled dependency carrying a build-script payload.
Building the aronenao crate resulted in the download and execution of a remote binary from https://23.254.165.112:9089/, with 23.254.165.112:443 serving as the command and control server. This attack vector exploited the build process to deliver and execute arbitrary code on developer machines.
The campaign also targeted other crates including arrayref, internment, and append-only-vec, which were trojanized, and published proc-macro1 as a typosquat of proc-macro2. All versions of aronenao have been removed from crates.io.
The incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- aronenao
- IPs
- 23.254.165.112
Remediation
- Remove aronenao from all dependency declarations and lock files
- Audit build logs and system activity from any machines that built aronenao during the affected period
- Check for unauthorized network connections to 23.254.165.112 on ports 9089 and 443
- Review and update all dependencies to ensure no other trojanized crates from the campaign are present (arrayref, internment, append-only-vec, proc-macro1)
- Regenerate any credentials or secrets that may have been exposed on affected build systems
Sources
- GitHub Advisory GHSA-vqfg-g9r4-x39f · GitHub Advisory Database
Cite this entry
"Malicious code in aronenao (crates.io)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 20, 2026; last updated August 21, 2026. https://supplychainattack.org/incident/malicious-code-in-aronenao-crates-io-18c86p
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in arone (crates.io)
arone is a malicious Rust crate published to crates.io on 2026-08-20 as part of a coordinated build-time payload campaign. The crate's build script downloads and executes a remote binary from an attacker-controlled server. All versions have been removed from crates.io.
CargoCompromised packageBuild-system compromise - resolvedcritical
Malicious code in tinymember (crates.io)
tinymember is a malicious Rust crate published to crates.io on 2026-08-20 as part of a coordinated campaign. The crate contained a build-script payload that downloads and executes a remote binary during compilation.
CargoCompromised packageBuild-system compromise - resolvedcritical
Malicious code in aovine (crates.io)
aovine is a malicious Rust crate published to crates.io on 2026-08-20 as part of a coordinated build-time payload campaign. The crate's build script downloads and executes a remote binary from an attacker-controlled server. All versions have been removed from crates.io.
CargoCompromised packageBuild-system compromise - containedhigh
M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions
M-Red-Team compromised AsyncAPI npm packages via GitHub Actions, injecting malicious code into the supply chain. The attack leveraged build system access to distribute compromised packages to downstream consumers.
M Red TeamnpmOtherCompromised packageBuild-system compromise