Wiz links North Korea to backdoored arrayref and two other Rust crates
This digest was compiled by AI from multiple sources — links to the originals are below.
Malicious versions of three Rust packages, including arrayref, were published to crates.io on August 20 with a build-time backdoor. The packages pulled a typosquatted dependency, proc-macro1, that downloaded and executed a second-stage payload during compilation. Wiz and StepSecurity linked the infrastructure to North Korean threat actors.
Key Facts
- Malicious versions of [email protected], [email protected], and [email protected] were published to crates.io on August 20.
- arrayref has 245 million all-time downloads, including 53.7 million in the 90 days before the attack, and is present in roughly 75 percent of environments that use Rust.
- The malicious dependency reconstructed a command-and-control URL from Base64 fragments, disabled TLS certificate validation, and downloaded a platform-specific second-stage payload during compilation.
- Wiz found the payload stealing host, username, and operating-system information and inspecting Chrome, Brave, and Edge profiles for saved logins and extension data.
- StepSecurity estimated exposure windows of 86, 90, and 107 minutes for the three crates, while the Rust Security Response Team reported removal roughly 86 minutes after the arrayref compromise.
The Malicious Crates
Malicious versions of arrayref, internment, and append-only-vec were published to crates.io on August 20 as [email protected], [email protected], and [email protected]. All three releases introduced a dependency on proc-macro1, a typosquat of the legitimate and widely downloaded proc-macro2 crate. The arrayref 0.3.10 package was pushed from the legitimate maintainer's account, and internment and append-only-vec followed about 20 minutes later. arrayref has 245 million all-time downloads, including 53.7 million in the 90 days before the attack, and is present in roughly 75 percent of environments that use Rust. The attack was first reported to RustSec and [email protected] by researcher jhobern, when only the arrayref compromise was known.
Build-Time Payload
The malicious dependency contained a build script that reconstructed a command-and-control URL from Base64 fragments, disabled TLS certificate validation, and downloaded a platform-specific second-stage payload. Because Rust build scripts run at compile time, building any project whose lockfile resolved arrayref 0.3.10 was enough to execute the payload, without calling any arrayref function. Wiz said the second-stage payload was selected by platform and supported x86_64 Linux, Windows, and macOS, plus aarch64 macOS. The payload collected host names, usernames, and operating-system information, enumerated installed applications, and inspected Chrome, Brave, and Edge profiles for saved logins and extension data. It could establish persistence through Windows Registry Run keys, macOS LaunchAgents, or Linux systemd user services, and included a fallback domain-generation mechanism for 10 .com domains every five days if the primary command-and-control server became unavailable.
North Korea Attribution and Removal
Wiz researchers said the payload infrastructure substantially overlaps with operations attributed to recent North Korean threat actors. StepSecurity estimated per-crate exposure windows at 86, 90, and 107 minutes before the packages were deleted along with associated attacker-owned crates. The Rust Security Response Team said it removed the malicious packages roughly 86 minutes after the arrayref compromise. The team confirmed that the new arrayref version had a direct dependency on proc-macro1, which executed a malicious build script. Shortly after, all malicious packages were removed and clean iterations were restored.
3 sources
Wiz links North Korea to backdoored arrayref and two other Rust crates
