Attackers compromised the maintainer account of the widely used Rust crate 'arrayref' to inject malicious code that executes during the compilation process on developers' systems. The attack represents a supply chain compromise targeting the Rust ecosystem, where developers unknowingly pull in malicious code as a dependency. The malware delivered is classified as an infostealer, designed to harvest sensitive information from affected developer machines. This type of attack is particularly dangerous because it targets the build pipeline, meaning any project depending on arrayref could have been silently compromised. The incident highlights ongoing risks in open-source package ecosystems where account takeover can lead to widespread downstream impact. Developers using the arrayref crate are advised to audit their dependencies and check for unauthorized changes to the package.
Attackers compromised the maintainer account of the popular Rust crate 'arrayref' and within a 23-minute window also poisoned 'append-only-vec' and 'internment' crates. The malicious releases were arrayref 0.3.10, append-only-vec 0.1.9, and internment 0.8.7. The attacker injected a dependency on a typosquatted package called 'proc-macro1' (impersonating 'proc-macro2'), which contained a 'build.rs' script that auto-executes during compilation. The script reconstructs infrastructure from base64-encoded fragments and selects OS-specific payloads for Linux x86-64, Windows x86-64, macOS x86-64, and macOS ARM64. On Unix systems, malware writes to /tmp/rust-setup, marks it executable, and launches as a detached process. On Windows, it creates %TEMP%\rust-setup.ps1 and uses hidden wscript.exe and VBS launcher. The payload connects to a C2 address. Second-stage capabilities include exfiltrating host info and credentials from Google Chrome, Brave, and Edge browsers via SQLite login database queries. Persistence is established via Registry Run key (Windows), LaunchAgent (macOS), and systemd (Linux). The attacker also published four additional crates (aovine, arone, aronenao, tinymember) that have since been removed. Versions 0.3.5 through 0.3.9 of arrayref were removed to force installation of the malicious 0.3.10. The attack began at 01:17 UTC on August 20 and the malicious packages were removed by 08:41 UTC, creating an exposure window of approximately 1.5 hours. Infrastructure overlaps with known DPRK (North Korean) supply chain attacks including Mastra and axios campaigns.
1. Developers who installed affected crates (arrayref 0.3.10, append-only-vec 0.1.9, internment 0.8.7) during the exposure window (approximately 01:17 to 08:41 UTC on August 20) should assume compromise. 2. Search Cargo.lock files for the malicious versions of the affected crates. 3. Look for dropped files: /tmp/rust-setup on Unix systems and %TEMP%\rust-setup.ps1 on Windows. 4. Review network traffic to 23.254.165[.]112 on ports 9089 and 443. 5. If compromise is confirmed: rotate all accessible credentials, CI tokens, signing keys, and other secrets; rebuild the environment from safe backups. 6. Clean projects should pin known-safe versions of the affected dependencies until the maintainer situation is clarified. 7. Check for persistence mechanisms: Registry Run keys (Windows), LaunchAgent entries (macOS), and systemd services (Linux). 8. Review browser credential stores for Google Chrome, Brave, and Edge for signs of unauthorized access.
IP: 23.254.165[.]112 (C2 server), Port: 9089 (C2 communication), Port: 443 (C2 communication), File: /tmp/rust-setup (Unix malware dropper), File: %TEMP%\rust-setup.ps1 (Windows malware dropper), Crate: proc-macro1 (typosquatted malicious package), Crate: arrayref version 0.3.10, Crate: append-only-vec version 0.1.9, Crate: internment version 0.8.7, Crate: aovine (malicious), Crate: arone (malicious), Crate: aronenao (malicious), Crate: tinymember (malicious), Process: wscript.exe (used as hidden launcher on Windows), Registry Run key persistence (Windows), LaunchAgent persistence (macOS), systemd persistence (Linux)
