Compiling almost any modern Rust GUI application today could have silently executed …

Top Story

Compiling almost any modern Rust GUI application today could have silently executed attacker code, because the supply chain trusted a single compromised account and Cargo’s own safety mechanism was used as the attack vector. On August 20, crates.io removed a poisoned 0.3.10 release of arrayref, a 245-million-download macro crate that sits deep in the dependency graph of most egui, eframe, and iced work through tiny-skia, sctk-adwaita, and winit.

The story is not a clever exploit. It is a textbook supply-chain attack that worked anyway, and it exposes three assumptions Rust teams lean on that all failed at once.

First, the typosquat. The droundy account that maintains arrayref and append-only-vec was compromised, and 0.3.10 added a single manifest line: [dependencies.proc-macro1], version 1.0.107. Cargo builds every declared non-optional dependency whether or not the code uses it, so that line alone forces a fetch and build of proc-macro1. That crate is a mechanical find-and-replace copy of real proc-macro2 — identical library source, working drop-in, real macro code in src/. Its build.rs does the dirty work, so builds keep succeeding while a payload runs. The metadata forges authors = ["David Tolnay <[email protected]>"] and points a repository field at a 404 path; dtolney is one letter off the real dtolnay. None of that is a sophisticated evasion. It is a paste-job that only looks wrong if you squint.

Second, Cargo’s yank mechanism was weaponized. The owner yanked the clean 0.3.5–0.3.9 releases, so Cargo printed its “consider updating to a version that is not yanked” warning — the exact nudge that moves developers onto the one remaining release, the malicious 0.3.10. The RustSec reporter who filed advisory-db#3161 says that is precisely how they got hit. The tool designed to steer people away from bad versions steered them onto the bad version.

Third, the payload is designed to survive the build. The host address 23.254.165.112:9089 and C2 address 23.254.165.112:443 are stored as base64 fragments and reassembled at compile time so the raw string never appears in source. Downloads use a TLS stack whose AcceptAll verifier accepts any certificate, so a self-signed cert on a raw IP passes. On Unix it drops /tmp/rust-setup, chmods it executable, and spawns it detached. On Windows it writes a PowerShell script and a VBScript launcher, runs them hidden through wscript.exe — the source comment notes this deliberately escapes Cargo’s job object so the child outlives the build — and then std::mem::forgets the child handle. No feature flag, no environment gate; it runs on every supported platform on every build.

The crates.io team has removed the malicious versions, and the code is gone: the entire github.com/droundy account returns 404, so upstream is not available for inspection. That is itself a problem — an incident you cannot audit leaves open questions about how much was taken from the account before the attack and what else might have been published under it.

What this changes is concrete and immediate. Every team that has shipped a Rust build since the compromised versions went up should treat those binaries as untrusted, not just grep their lockfiles for proc-macro1. The IOCs are public — the IPs, the SHA256s of 0.3.10 and 1.0.106/1.0.107, the second-stage names rust-crate_0.1.0 through _0.4.0 — and the payload itself was fetched per-OS, so a Linux CI artifact and a developer’s Windows machine could hold different malware entirely.

The one party whose move decides the lasting damage is the Rust project itself. arrayref has no build script and no runtime dependencies through 0.3.9 — the crate was four macros — and a single line added an entire remote-code-execution chain. The question that outlasts this cleanup is whether Cargo gets a structural fix: a warning when a crate whose code never references a dependency still pulls it in, or stricter scrutiny of new maintainer-published versions of trusted crates. Absent that, the next compromised account will not bother with base64. It will just add the dependency line again. Malicious Rust crate Arrayref runs a build-time payload

Also Today

Mojo is now open source · Source Mojo, the AI-focused language Modular has built with a closed compiler since 2021, is now fully Apache 2.0 with LLVM exceptions, compiler and toolchain included, a week after 1.0 brought source stability. The build runs through Bazel, and a prebuilt flag keeps nightly binaries available. Notably, Modular is not yet accepting compiler contributions — it wants them by year’s end — a deliberate stance in the era of AI-generated patches. The license choice matters: Apache with LLVM exceptions is the maximal-freedom standard for compilers. Open-sourcing the compiler is the difference between a language the community can audit and one it must take on faith, and trust is exactly the currency a young systems language needs to earn.

The August 17 outage, and the work ahead · Source GitHub’s postmortem confirms the August 17 outage, seven hours and forty-seven minutes, was a capacity failure rather than a bad deploy: traffic hit a new peak, a Central US component failed to scale, and a Copilot client retry loop stretched out recovery. Monthly commits have climbed from 1.4 billion to 2.9 billion since April, and August produced a second significant incident after the August 6 Actions failure. GitHub has added 3 million CPU cores and 120 petabytes of storage, and Azure now handles 58% of platform load. The concrete fixes — retry budgets, variable timeouts, isolated critical systems — matter more than the numbers, because the only way to earn back developer trust after two outages in a month is measured engineering, not apology.

AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint · Source A deep dive shows the AliExpress homepage silently runs two WebAudio graphs from Alibaba’s obfuscated AWSC security scripts, collina.js and fireyejs.js, each generating a sawtooth waveform through an analyser into a zero-gain node connected to the system audio destination. With no media element, tab mute does nothing, and on the author’s setup the active audio path blocked Bluetooth multipoint from switching back to his phone. It is part of a broad canvas, WebGL, WebRTC, and timing fingerprint. The measured side effect is the tell: however legitimate the anti-fraud intent, a silent background audio graph that can change how your headphones behave is a privacy cost users were never asked to consent to.

Alibaba’s AI Spending Spree, Concerns of Circular AI Financing | Bloomberg Tech 8/20/2026 · Source Bloomberg’s report on Alibaba frames the AI build-out in dollar terms, flagging a capex quarter on the order of $10 billion alongside growing concern about circular AI financing — the pattern where hyperscalers’ AI spending flows back to the same providers they buy from. The worry echoes the Meta-on-Azure story, where one giant’s AI budget becomes another giant’s revenue. At this scale the question stops being whether any single model or datacenter is worth it and becomes whether the whole loop returns more than the capital it consumes. When the largest AI buyers are also the largest AI sellers, the industry’s growth metrics start to need an auditor as much as a ledger.

DiffusionGemma Technical Report · Source DiffusionGemma, an experimental open-weight Google model, skips token-by-token decoding and refines 256-token blocks in parallel, reaching roughly 1,500 output tokens per second on a single H100 — faster than autoregressive models even with speculative decoding. Instead of training from scratch, it fine-tunes the Gemma 4 mixture-of-experts model (3.8B activated, 25.2B total) on under 10% of the starting token budget, using supervised denoising then RL plus sampler distillation. It retains thinking mode, multimodal inputs, and long contexts. The Pareto-frontier claim for the speed-versus-capability trade-off is the part to verify independently, but removing sequential decoding as the throughput bottleneck is the genuinely new structural result here.

In Brief

• People-search service ClarityCheck left more than nine million reverse-image face photos in an unsecured S3 bucket, researcher Jeremiah Fowler reported. (Source)
• Two US senators demanded TikTok explain an experiment that withheld a safety feature from millions of users, including a teenager who died by suicide. (Source)
• Meta has quietly become one of Microsoft’s largest AI customers, spending hundreds of millions of dollars a year on Azure and reviving circular-financing concerns. (Source)
• ChatGPT’s latest Mac update adds Apple Messages integration on the desktop app. (Source)
• ChatGPT search now applies the site: operator at scale, a shift GEO-watchers are tracking closely. (Source)
• Cloudflare’s task-based OAuth consent is maturing, with thousands of third-party apps and more than a million authorizations since June. (Source)
• Simon Willison’s research repo shows a shot-scraper-style JSON API built on Bun 1.4’s new Bun.WebView. (Source)
• fx, a tiny open native coding agent at v0.0.4, ships as a curl-to-bash install and is flagged experimental. (Source)
• OpenAI launched AI Futures, a new blog on how transformative AI could reshape power, governance, the economy, and individual freedom. (Source)
• Anthropic says Mythos-class models arrive this fall with customer-owned data and none retained, subject to enterprise privacy and compliance rules. (Source)
• With GPUs scarce, Wall Street has begun trading compute futures — essentially a forward market for H100 capacity. (Source)
• Blue Arrow’s Zhuque-3 achieved China’s first rocket first-stage land recovery, landing as its IPO faces key regulatory scrutiny. (Source)

One Line

If you were trying to ship software that day, we let you down.

— GitHub, in its August 17 outage postmortem