Vulnerabilities · 52 days ago
Wiz and SecurityWeek say the August 20 crates.io poisoning of arrayref, internment, and append-only-vec now points to North Korean actors, and the malicious releases were deleted within roughly 86 to 107 minutes. The campaign also added a fake proc-macro1 dependency that turned normal compilation into the delivery path.
Cargo made the trick work: when a project compiled, the dependency’s build script ran automatically and downloaded a second-stage payload, so developers and CI runners could be hit without calling any crate function. That means a clean uninstall after deletion does not rule out prior compromise on laptops or build systems that built the tainted revisions, and the evidence may live in build logs and artifacts rather than the registry.
For teams that compile Rust dependencies automatically, the lasting exposure is historical build activity, not today’s crate list. The short removal window makes this a forensic problem as much as a cleanup problem, and the North Korea attribution puts it in the same supply-chain pattern as earlier linked campaigns.
9 sources covering this story
Hackers poison popular Rust crates to steal developers' credentials
Malicious updates turned routine builds into a delivery system for infostealer malware
North Korean Hackers Tied to Rust Supply Chain Attack
Cybersecurity researchers have linked a malicious backdoor in compromised Rust packages to previous North Korean supply chain attacks
Rust Supply Chain Attack Linked to North Korean Hackers
Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server.
Backdoored Rust packages hit crates.io, exposing developers to malware at build time
Researchers found significant infrastructure overlap between the attack on three Rust crates and recent North Korea-linked campaigns.
Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
Rust deletes malicious releases of three crates after a proc-macro1 build script downloaded and ran a remote payload during compilation.
Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns | Wiz Blog
Malicious versions of the arrayref Rust crate (and others) executed a backdoor at compile time.
Popular Rust Crates Compromised in Build-Time Supply Chain Attack
Three compromised Rust crates pulled in a malicious dependency that downloaded and executed cross-platform malware during Cargo builds.
Hackers poison arrayref Rust crate to push infostealer malware
Hackers compromised the maintainer account behind the widely used Rust crate arrayref to introduce malware that executed on developers' systems during compilation.
Rust Crates arrayref & append-only-vec Compromised
Popular Rust crates arrayref and append-only-vec were compromised via a typosquatted proc-macro1 dependency that runs malicious code at build time.
Part of the PlainSec briefing for 2026-08-24