SlowMist said a Rust supply chain attack affected three legitimate libraries: arrayref@0.3.10, internment@0.8.7 and append-only-vec@0.1.9.
According to the group’s monitoring, the compromised versions introduced a malicious dependency called proc-macro1. It can automatically download and execute cross-platform malware during the Cargo build process.
SlowMist said arrayref is widely used across the Rust ecosystem. Its earlier clean version, v0.3.9, had about 152 million downloads. The library also appears indirectly in the dependency chains of several common Rust GUI frameworks, and it has broad coverage in the Solana ecosystem, including token, staking and validator-related components. SlowMist added that those usage figures do not mean the related projects or hosts have been compromised.
The group said attackers could carry out remote code execution during builds, host profiling, persistence, browser data theft, and the execution of other scripts or shell commands.
SlowMist advised users to check Cargo.lock files and build environments for affected versions, use exact version pinning, verify the version actually resolved in Cargo.lock, rotate any potentially exposed credentials, and rebuild affected systems in a trusted environment.