Rust Supply Chain Compromised: Backdoored Packages Traced to North Korea-Linked Infrastructure

On August 20, attackers slipped malicious versions of three Rust packages onto the crates.io registry, including the popular arrayref library, embedding a backdoor that triggered automatically the moment affected projects were built.

The three tainted releases were arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9. Each was modified to pull in a new dependency called "proc-macro1" — a name deliberately designed to impersonate the popular and legitimate "proc-macro2" crate.

That fraudulent dependency carried a build script that fetched and ran a second-stage payload during the compilation process itself. Wiz noted the payload was tailored to the target system, with versions built for 64-bit Linux, Windows, and macOS machines, as well as Apple Silicon Macs.

Research from StepSecurity highlighted just how far-reaching the exposure could have been: arrayref alone has racked up roughly 245 million downloads over its lifetime, with more than 53 million of those occurring in just the past three months. The firm calculated that each compromised package remained live for roughly 86 to 107 minutes before being pulled from the registry along with related malicious crates.

No user interaction needed, What made this attack particularly dangerous is that it didn't require developers to run any code manually or even invoke functions from the compromised library. As StepSecurity explained, Rust's build scripts execute automatically during compilation, meaning any project that happened to resolve arrayref 0.3.10 in its dependency lock file would trigger the malicious payload — without the library's actual code ever being called.

Once a project pulled in the tainted package, its configuration file (Cargo.toml) automatically added proc-macro1 as a dependency. From there, the malicious code reassembled a command-and-control server address from Base64-encoded fragments, turned off TLS certificate checks, retrieved a payload suited to the victim's operating system, and ran it as a routine part of the build.

Ramifications of payload:

Wiz's analysis found the malware gathering details about the infected machine — hostname, username, and OS information — while also cataloging installed software and digging through Chrome, Brave, and Edge browser profiles for saved credentials and extension data.

Beyond data collection, the malware was capable of embedding itself permanently in the system using Windows Registry Run keys, macOS LaunchAgents, or Linux systemd user services. It could also receive remote commands to update its own configuration, shut itself down, or fetch and execute additional scripts.

The malware's reach extended across all three major operating systems, including Apple's M-series chips. As a resilience measure, it included a backup domain-generation algorithm capable of producing ten new ".com" fallback addresses every five days in case its primary control server went offline.