North Korean Hackers Poisoned Popular Rust Crates

On Aug. 20, attackers published a poisoned release of [email protected] to crates.io from the legitimate maintainer’s account. About 20 minutes later, tainted versions of internment and append-only-vec, two other crates owned by the same maintainer, were also uploaded. Several attacker-controlled crates — aovine, arone, aronenao and tinymember — referenced the same malicious dependency.

The impersonating package, [email protected], pretended to be the legitimate proc-macro2 crate. The package hid a build script named build.rs that disabled TLS certificate validation and attempted to download a platform-specific second-stage binary over an encrypted connection.

Rust’s Security Response Team removed the malicious packages roughly 86 minutes after the initial publish and restored clean releases. The team wrote: “a new version of the arrayref crate was published with a direct dependency on proc-macro1, which would execute a malicious build script.” The group added it has not found evidence that the poisoned crates were used in downstream builds and indicated the arrayref maintainer’s computer or credentials were likely compromised: “We do not believe the author of arrayref to be acting maliciously, but their computer or credentials are likely compromised, and we are attempting to contact them.”

Security firm Wiz attributed the incident to the North Korean threat actor Sapphire Sleet and linked the campaign to earlier NPM supply-chain attacks known as Axios and Mastra. Wiz reported that arrayref payloads beaconed to an endpoint used in the Mastra operation, that command-and-control traffic reached an IP tied to the Axios campaign, and that the same Hostwinds LLC IP range was used across these incidents.

Analysis by StepSecurity found that the attacker created typosquatted versions of proc-macro2 and an impersonating account immediately before publishing the poisoned arrayref release.

Arrayref is an array-conversion utility with more than 245 million downloads and appears in roughly 75% of Rust environments. Because build-time scripts can run during compilation or installation, a compromised dependency can execute code in downstream builds and affect many projects automatically.