North Korean Hackers Poisoned One of Rust's Most Downloaded Packages
A supply chain attack targeting the Rust ecosystem has been attributed to North Korean threat actors, with cybersecurity firm Wiz pointing the finger at a group known as Sapphire Sleet.
The attack landed on 20 August and went straight for arrayref, a widely-used array-conversion crate with over 245 million downloads. If you work with Rust, you almost certainly have it somewhere in your dependency tree. Wiz estimates it shows up in around 75% of Rust environments.
The attackers didn't bother creating a fake package from scratch. They pushed a malicious version, [email protected], directly from the legitimate maintainer's account. The account had apparently been compromised. About twenty minutes later, two more crates from the same maintainer, internment and append-only-vec, received poisoned releases as well.
All of these pointed back to a shared malicious dependency: a typosquatted version of the popular proc-macro2 package, cleverly renamed proc-macro1. Buried inside it was a build script, build.rs, which fetched a platform-specific second-stage payload over TLS, with certificate validation conveniently disabled.
The attackers also registered several of their own crates, aovine, arone, aronenao, and tinymember, all funnelling through the same rogue dependency. It was a tidy little web.
The Rust Security Response Team spotted the problem and pulled the malicious packages roughly 86 minutes after the initial compromise. Their post-incident statement confirmed that the poisoned arrayref release had introduced a direct dependency on proc-macro1, which would execute the malicious build script during compilation. Clean versions were restored, and the team found no evidence that anyone had actually built with the compromised packages.
On the maintainer, the team was clear: 'We do not believe the author of arrayref to be acting maliciously, but their computer or credentials are likely compromised, and we are attempting to contact them.'
Analysis from StepSecurity suggests this wasn't improvised. The typosquatted proc-macro2 package and the impersonating account were both created shortly before the poisoned arrayref version went live. Someone planned ahead.
The North Korea connection comes from infrastructure overlaps that Wiz describes as substantial. Sapphire Sleet, the same group behind NPM supply chain attacks targeting Axios in April and Mastra in June, appears to have run the same playbook here. The arrayref payloads beaconed to an endpoint used in the Mastra attack. Command-and-control traffic was recorded to an IP that appeared in the Axios campaign. All three incidents share the same IP range belonging to hosting provider Hostwinds LLC.
Eighty-six minutes between attack and takedown sounds fast. But in software supply chain terms, that's still more than enough time to do serious damage if anyone happened to be running a build.