rust3 articles
North Korean Hackers Poisoned One of Rust's Most Downloaded Packages
North Korean hackers, likely the group Sapphire Sleet, carried out a supply chain attack on the Rust ecosystem on August 20, compromising the widely-used *arrayref* crate by publishing a malicious version from its legitimate maintainer's hijacked account. The poisoned package contained a hidden build script designed to fetch a malicious second-stage binary, with the attack also spreading to several other related crates. The Rust Security Response Team removed all malicious packages within 86 minutes, found no evidence of actual usage, and linked the incident to previous North Korean-attributed NPM attacks based on shared infrastructure.
Poisoned Rust Packages Spent 90 Minutes Stealing Developer Credentials Before Anyone Noticed
Hackers injected malware into several popular Rust packages, including arrayref, internment, and append-only-vec, by compromising a developer's credentials and publishing poisoned versions that fetched second-stage malware capable of stealing browser data, cryptocurrency wallet information, and establishing persistent remote access. The malicious releases were live for under two hours before the Rust Security Response Team removed them, though arrayref's roughly 245 million lifetime downloads highlights the potential reach of such an attack. Developers have been advised to audit their Cargo lockfiles and local registry caches for the affected packages.
AmnesiaStealer: The macOS Malware That Watches You Browse in Real Time
is a newly discovered Rust-based macOS malware distributed via a fake GitHub page using ClickFix-style social engineering, tricking victims into running a malicious Terminal command. Once installed, it harvests sensitive data including browser databases, keychains, Apple Notes, and documents, while also attempting to bypass macOS's TCC framework to gain broader access. A particularly notable feature is its remote-control "stream module," which uses the Chrome DevTools Protocol to launch a hidden browser session, giving attackers live, interactive control over the victim's browsing activity.