North Korean hackers, likely the group Sapphire Sleet, carried out a supply chain attack on the Rust ecosystem on August 20, compromising the widely-used *arrayref* crate by publishing a malicious version from its legitimate maintainer's hijacked account. The poisoned package contained a hidden build script designed to fetch a malicious second-stage binary, with the attack also spreading to several other related crates. The Rust Security Response Team removed all malicious packages within 86 minutes, found no evidence of actual usage, and linked the incident to previous North Korean-attributed NPM attacks based on shared infrastructure.
