A poisoned Rust crate lived 86 minutes, and a fake installer lived on Anthropic's own domain

Two supply-chain attacks landed within weeks of each other that both worked by borrowing someone else's trust rather than by breaking anything. On August 20, 2026, the Rust security team published RUSTSEC-2026-0260 for the widely used arrayref crate, whose version 0.3.10 pulled in a dependency that downloaded and executed a remote binary at build time. The advisory says the package was removed roughly 86 minutes after publication. Separately, a malvertising campaign used a real claude.ai shared-conversation page as the landing page for Mac malware.

Key facts

• arrayref 0.3.10 depended on proc-macro1 1.0.107, whose build.rs fetched and ran a remote binary; published and removed on 2026-08-20, about 86 minutes apart.
• The attacker pre-staged a clean proc-macro1 1.0.106 first, so the malicious bump would look like a routine patch release. This is recorded in RustSec issue #3161.
• The second campaign bought Google Ads on searches for installing Claude Code on Mac, leading to a genuine claude.ai/share page titled "Running Claude Code on Mac" and labeled "Shared by Apple Support."
• Primary sources: the RustSec advisory and the Rust project's own writeup; the security firm Huntress reverse-engineered the Mac payload.

Start with the Rust incident, because the mechanics are clean. arrayref is a small, boring, extremely widely depended-upon utility crate. When version 0.3.10 was published, it added a dependency nobody expected: proc-macro1, a name designed to be misread as the legitimate and ubiquitous proc-macro2. That package contained a build.rs -- a build script, code that Rust runs on your machine during compilation -- which downloaded and executed a binary from a remote server.

The critical word is "during compilation." A build script does not wait for you to call the library. It runs when you build, which means it runs on developer laptops and, more importantly, on continuous integration machines that typically hold deployment credentials.

The detail that should worry people most is the staging. Issue #3161 records that proc-macro1 version 1.0.106 was a clean copy published beforehand, with the malicious payload arriving in 1.0.107. That defeats the standard heuristic. Security tooling and human reviewers both watch for brand-new packages appearing as dependencies; a package with an existing benign version and a normal-looking patch bump reads as maintenance.

Eighty-six minutes sounds like a fast response, and it was. It is also long enough for a lot of continuous integration to run.

The second incident used no vulnerability at all. According to Huntress and an independent technical writeup, attackers bought Google Ads targeting people searching for how to install Claude Code on a Mac. The ad led to a page on claude.ai -- Anthropic's real domain, using Anthropic's ordinary feature for sharing a conversation publicly. The page was titled "Running Claude Code on Mac" and carried the label "Shared by Apple Support." It walked the reader through pasting a command whose download URL was hidden in base64, piped straight into a shell. Huntress traced the result to a six-stage information-stealer and remote-access-trojan chain they call MacSync.

Nothing was hacked. The attacker rented two pieces of trust that were for sale: a paid search placement above the genuine vendor result, and a legitimate domain that hosts user-generated content. Both are working as designed.

That is what connects the two stories. The habit that both exploit is the same one: a developer needs to install something, asks a search engine or a chatbot, and runs the first convincing answer. Shared model conversations have become a normal medium for passing around setup instructions, and a shared conversation hosted on a frontier lab's own domain inherits the lab's credibility whether or not the lab wrote a word of it.

An analogy: a corkboard in a hospital lobby. The hospital is real, the board is real, and anyone can pin a notice to it. Readers extend the building's authority to the paper.

Neither incident is a model failure, and it is worth being precise about that, because the reflexive framing is "AI made this happen." It did not. The arrayref attack would have worked identically in 2019. The MacSync lure needed AI only in the sense that Claude Code is a thing people install.

The honest caveat is that neither attack is technically novel, and a security professional could reasonably call both of them ordinary. What makes them worth reporting together is that the defensive advice people actually give -- "check the domain," "look at whether the package is new" -- failed cleanly in both cases. The domain was correct. The package had history.

What does work: go to the vendor's own documentation rather than a search result, decode any obscured download URL before you run it, treat an unexpected transitive dependency carrying a build script as a compromise event rather than a lockfile diff, and scan your build cache after an advisory rather than assuming removal from the registry protected you. The Hacker News discussion on the Rust incident spent most of its energy on exactly that last point.

Related reading on this site: data poisoning and backdoor attacks, model file formats: safetensors and GGUF, and an evaluation agent tried a supply-chain attack on a real open-source project.

---

Originally published on Ground Truth, where every claim is checked against the primary source.