North Korean hackers poison Rust crate ecosystem
Rust supply chain attack linked to North Korean hackers
On August 20, attackers compromised the maintainer account behind the widely used Rust crate arrayref -- an array-conversion utility with over 245 million lifetime downloads found in approximately 75% of Rust environments -- to push a malicious version that executed infostealer malware on developers' systems during compilation. Within a 23-minute window, two other crates by the same maintainer, append-only-vec and internment, were also poisoned.
The attacker injected a dependency on proc-macro1, a typosquat impersonating the legitimate proc-macro2 crate. A malicious build.rs script in the dependency automatically executed during compilation, reconstructing its payload from base64-encoded fragments and selecting a platform-specific second-stage binary (Linux x86-64, Windows x86-64, macOS x86-64, and macOS ARM64). The second-stage malware exfiltrated browser credentials from Chrome, Brave, and Edge by querying SQLite login databases, and established persistence via Registry Run keys (Windows), LaunchAgent (macOS), and systemd (Linux).
Projects using arrayref include blake3, the egui and iced GUI frameworks, and components used in Ethereum and Solana. Cybersecurity firm Wiz linked the attack to the North Korean threat actor Sapphire Sleet, citing substantial infrastructure overlaps with previous NPM supply-chain attacks against the Axios and Mastra packages. The malicious packages were removed from crates.io approximately 86 minutes after publication. Developers who installed during the exposure window are advised to rotate all credentials, CI tokens, and signing keys, and rebuild from safe backups.