Three widely used Rust packages were briefly hijacked on August 20, 2026, injecting malware into developer builds and putting critical blockchain infrastructure, including Solana’s, in the blast radius. The malicious versions remained live on the crates.io registry for 86 to 107 minutes within a tight 23-minute window. The arrayref package, a foundational component in Solana’s ecosystem, had accumulated between 152 and 245 million lifetime downloads. The risks included remote code execution and credential theft. Researchers at Wiz linked the attack to North Korean cyber actors tracked as Sapphire Sleet. No widespread exploits or project-specific compromises have been publicly reported at this stage.
Source: Read the original article
