The maintainer account behind the widely used Rust crate arrayref was compromised, leading to the distribution of malware that executed on developers' systems during compilation. The attacker also poisoned two other crates, append-only-vec and internment, within a 23-minute window in the same supply-chain attack. Arrayref is a popular library with more than 53 million downloads in the past 90 days, used by cryptography, graphics, and blockchain tools. The malicious releases were arrayref 0.3.10, append-only-vec 0.1.9, and internment 0.8.7, all tied to the same account.
The hacker injected a dependency on a typosquatted package called proc-macro1, impersonating the legitimate proc-macro2 crate, while leaving the rest of the upstream source code unchanged. According to a report from application security company StepSecurity, a script in proc-macro1 named build.rs runs automatically during compilation, reconstructing its infrastructure from base64-encoded fragments and picking a payload for the host operating system. The payload targets Linux x86-64, Windows x86-64, macOS x86-64, and macOS ARM64. StepSecurity also noted that the attacker published multiple versions of four crates themselves, aovine, arone, aronenao, and tinymember, which have since been removed from crates.io.
On Unix systems, the malware writes to /tmp/rust-setup, marks it executable, and launches it as a detached process. On Windows, it creates %TEMP%\rust-setup.ps1 and uses a hidden wscript.exe and VBS launcher to keep running. The payload receives an address as an argument, believed to be a command-and-control address. Analysis from cloud security company Wiz indicates the second stage includes exfiltrating host information and credentials, specifically from Google Chrome, Brave, and Edge browsers by querying SQLite login databases.
Persistence is established through the Registry Run key on Windows, LaunchAgent on macOS, and systemd on Linux. The potential impact is significant, as arrayref alone has more than 245 million lifetime downloads, while append-only-vec and internment collectively account for nearly 19 million installs. Projects using arrayref include blake3, Rust GUI frameworks such as egui, eframe, and iced, and components used in Ethereum and Solana.
The attack began at 01:17 UTC on August 20, when a GitHub account impersonating prominent Rust developer David Tolnay was created, followed by a similar account in the crates.io registry. At 01:55, the attacker published proc-macro1@1.0.106, a benign copy of proc-macro2, then pushed a malicious update through version 1.0.107, published at 7:11. At 07:15, arrayref 0.3.10 was published through the legitimate droundy (David Roundy) account, while versions 0.3.5 through 0.3.9 were removed, potentially to force installation of the malicious release. The incident was reported at 07:54, with crates.io deleting proc-macro1 at 08:03 and removing arrayref 0.3.10 from the index at 08:41.
Cybersecurity firms StepSecurity, SafeDep, and Aikido have each published technical analyses of the attack, sharing indicators of compromise. Wiz researchers noted that the campaign's infrastructure overlaps with recent North Korean supply chain attacks, including those against Mastra and axios. Developers who installed the affected packages during the exposure window of nearly 1.5 hours should assume compromise, and are advised to check Cargo.lock files, look for dropped files, and review traffic to 23.254.165[.]112 on ports 9089 and 443. Where compromise is confirmed, the recommendation is to rotate all accessible credentials, CI tokens, signing keys, and other secrets, and rebuild the environment from safe backups.
More cybersecurity news from TechManNews.
