← Back to feed

On August 20, 2026 at 07:15 UTC, a malicious version of arrayref was published to crates.io from the legitimate maintainer’s account. Within 23 minutes, two more crates from the same owner — internment and append-only-vec — were similarly poisoned. The Rust Security Response Team pulled the packages within 86 to 107 minutes. All three carried a build-time backdoor linked by Wiz Research to North Korea’s Sapphire Sleet group.

What Happened

The attack vector was a typosquatted dependency. The malicious arrayref@0.3.10 added a new direct dependency on proc-macro1, a crate impersonating the legitimate proc-macro2 (154 million downloads). The attacker published proc-macro1@1.0.107 two hours before the arrayref release to let it sit unsuspected.

proc-macro1’s build.rs file is executed automatically by Cargo at compile time. It reconstructed download infrastructure from base64-encoded fragments and fetched a platform-specific second-stage binary over TLS: Linux x86-64, Windows x86-64, macOS x86-64, and macOS arm64 variants were all present on the payload host.

The second stage is a featureful backdoor:

• Beacons to C2 at /49890878 via HTTPS POST, sending Base64-encoded host info and credentials
• Collects saved logins from Chrome, Brave, and Edge by querying SQLite login databases directly
• Installs persistence via the Registry (Windows), LaunchAgent (macOS), or systemd (Linux)
• Accepts remote commands: kill, startup, minicfg, and run (execute arbitrary scripts synchronously or in background)

Scale

arrayref is a ten-year-old array-conversion utility with 245 million total downloads, present in approximately 75% of environments where Rust is used. Most users had older pinned versions in their lockfiles — the malicious release was downloaded 2,285 times, less than 10% of arrayref’s total traffic across all versions during the exposure window. RustSec advisory RUSTSEC-2026-0260 was issued same-day.

Any developer workstation or CI runner that executed cargo build while the poisoned packages were live must be treated as compromised. Credentials, tokens, signing keys, and CI secrets reachable from affected machines should be rotated, and artifacts produced during the window rebuilt from clean sources.

North Korean Attribution

Wiz Research identified substantial infrastructure overlap with prior DPRK Sapphire Sleet operations.

The C2 endpoint /49890878 appears in the Mastra campaign, attributed to DPRK by Microsoft. C2 traffic in this incident was recorded to 23.254.167.216, an IP that appears in Google Cloud Threat Intelligence’s analysis of UNC1069’s axios npm attack, which Mandiant links to North Korea. All three incidents use infrastructure in the 23.254.164.0/23 range operated by Hostwinds LLC.

The pattern is clear: Sapphire Sleet is running systematic supply chain operations across the developer toolchain — npm (axios, Mastra), now Rust. The attack sequence here was also precise: the impersonation account on GitHub was created at 01:17 UTC, the typosquat was published at 07:11, arrayref was poisoned at 07:15, and the report arrived at 07:54.

AI Developer Exposure

The AI toolchain runs Rust. Inference engines including candle and burn, CLI coding agents including Codex CLI’s Rust harness wrapper, and several model serving frameworks all use Rust packages at build time. AI coding agents that automate cargo build on developer machines would have triggered the payload automatically — the build-time execution model means no user interaction is required beyond dependency resolution.

This is the first confirmed major supply chain attack on crates.io by a DPRK-attributed actor. npm has been targeted repeatedly over the past six months. PyPI saw a similar campaign pattern in early 2026. The escalation to Rust closes the remaining major package registry gap in what appears to be a systematic DPRK effort to compromise developer environments across all major language ecosystems.

What to Check

find ~/.cargo/registry/cache -type f \( \
  -name 'arrayref-0.3.10.crate' -o \
  -name 'internment-0.8.7.crate' -o \
  -name 'append-only-vec-0.1.9.crate' -o \
  -name 'proc-macro1-*.crate' -o \
  -name 'proc-macro-en-*.crate' -o \
  -name 'aovine-*.crate' -o \
  -name 'arone-*.crate' -o \
  -name 'aronenao-*.crate' -o \
  -name 'tinymember-*.crate' \
\) -print

The malicious versions are no longer accessible on crates.io. The clean versions of arrayref (up to 0.3.9), internment, and append-only-vec have been restored.