{"id":9210,"date":"2026-08-21T09:29:49","date_gmt":"2026-08-21T09:29:49","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9210"},"modified":"2026-08-21T09:29:49","modified_gmt":"2026-08-21T09:29:49","slug":"backdoored-rust-packages-hit-crates-io-exposing-developers-to-malware-at-build-time","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9210","title":{"rendered":"Backdoored Rust packages hit crates.io, exposing developers to malware at build time"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Malicious versions of three Rust packages, including the widely used arrayref, were published to the crates.io registry on August 20, carrying a backdoor that executed automatically when affected projects were compiled.<\/p>\n

Security researchers at Wiz said the attack also shares infrastructure with recent supply-chain campaigns attributed to North Korean threat actors.<\/p>\n

The compromised releases were \u201carrayref@0.3.10\u201d, \u201cinternment@0.8.7,\u201d and \u201cappend-only-vec@0.1.9.\u201d All three introduced a dependency on \u201cproc-macro1,\u201d a typosquat of the legitimate and widely downloaded \u201cproc-macro2\u201d crate.<\/p>\n

The malicious dependency contained a build script that downloaded and executed a second-stage payload during compilation, Wiz researchers said in a blog post<\/a>. \u201cThe second stage payload is selected based on the platform, with support for x86_64 versions of Linux, Windows, and macOS, in addition to aarch64 macOS,\u201c they added.<\/p>\n

A StepSecurity analysis<\/a> noted that arrayref has 245 million all-time downloads, with 53.7 million of them happening in the last 90 days. The cybersecurity outfit estimated per-crate exposure windows at 86, 90, and 107 minutes, respectively, before all of them were deleted along with other associated crates.<\/p>\n

The attack was first reported<\/a> to RustSec and security@rust-lang.org by researcher jhobern<\/a>, but only the arrayref compromise was known at the time.<\/p>\n

<\/a>The malicious code ran at build time<\/h2>\n

The attack did not require developers to execute suspicious code or even call a function from arrayref. \u201cBecause Rust build scripts run at compile time, simply building any project whose lockfile resolved arrayref 0.3.10 was enough to detonate the payload. The crate\u2019s code never needs to be called,\u201d StepSecurity researchers said.<\/p>\n

When the affected package was built, the \u201cCargo.toml\u201d configuration file added proc-macro1 as a dependency. This dependency then reconstructed a command-and-control (C2) URL from Base64 fragments, disabled TLS certificate validation, downloaded a platform-specific payload, and executed it as part of the normal build process.<\/p>\n

Wiz found the payload collecting host, username, and operating-system information, enumerating installed applications and inspecting Chrome, Brave, and Edge profiles for saved-login and extension information.<\/p>\n

It could also establish persistence through Windows Registry Run keys, macOS LaunchAgents or Linux systemd user services, and accept commands to reconfigure itself, terminate, or download and execute scripts.<\/p>\n

The payload supported Linux, Windows, and macOS, including Apple Silicon Macs. It featured a fallback domain-generation mechanism that could generate 10 .com domains every five days if the primary C2 became unavailable.<\/p>\n

<\/a>Links to North Korean campaigns<\/h2>\n

Wiz said the payload\u2019s infrastructure \u201csubstantially overlaps\u201d with operations attributed to recent DPRK actors.<\/p>\n

The strongest link is the C2 request path, it said. The backdoor communicates with an endpoint also used in the Mastra<\/a> campaign, which Microsoft attributed to the DPRK<\/a>-linked Sapphire Sleet. The IP infrastructure used in the arrayref campaign also shares an SSL certificate issuer with the infrastructure associated with that operation.<\/p>\n

Another connection was found with the Axios<\/a> npm supply-chain campaign. Wiz said a victim reported C2 traffic involving an IP address that also appeared in Google Cloud Threat Intelligence\u2019s analysis of the Axios attack, which Mandiant has linked<\/a> to North Korea. <\/p>\n

Wiz recommended that organizations search \u201cCargo.lock\u201d files and local Cargo caches for the compromised versions and attacker-controlled packages. It also said that any developer workstation or CI runner that actually built an affected project should be treated as compromised, with accessible credentials, tokens, and keys rotated and artifacts rebuilt from clean sources.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Malicious versions of three Rust packages, including the widely used arrayref, were published to the crates.io registry on August 20, carrying a backdoor that executed automatically when affected projects were compiled. Security researchers at Wiz said the attack also shares infrastructure with recent supply-chain campaigns attributed to North Korean threat actors. The compromised releases were […]<\/p>\n","protected":false},"author":0,"featured_media":9211,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9210","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9210"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9210"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9210\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9211"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9210"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9210"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9210"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}