Malicious versions of the arrayref Rust crate and other packages were found executing a backdoor at compile time, targeting developers through the Rust ecosystem. The campaign's infrastructure shows significant overlap with known North Korean (DPRK) supply chain attacks, including those involving the Mastra and axios packages. The attack is a compile-time supply chain compromise, meaning the malicious code runs during the build process rather than at runtime. This technique makes detection harder as traditional runtime security tools may miss it. The campaign is attributed to DPRK-linked threat actors based on infrastructure overlaps with prior operations. Developers using affected crates may have unknowingly executed malicious code during their build pipelines.
On August 20, 2026, malicious versions of three Rust crates were published to crates.io: arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9. These crates introduced a typosquatted dependency called proc-macro1 (mimicking the legitimate proc-macro2 with 154M+ downloads). The malicious build.rs script in proc-macro1: (1) reconstructs a C2 URL from Base64 fragments (https://23.254.165[.]112:9089/), (2) disables TLS certificate validation via a custom AcceptAll verifier, (3) downloads a platform-specific payload based on OS and architecture (supporting x86_64 Linux/Windows/macOS and aarch64 macOS), (4) writes it to /tmp/rust-setup (Unix) or %TEMP%\rust-setup.ps1 (Windows), and (5) executes the payload passing the C2 beacon address as an argument. Because Cargo executes build scripts at compile time, simply building an affected project triggers the payload. The second-stage backdoor beacons to C2 via HTTPS POST to /49890878, exfiltrating host info and stolen credentials as Base64-encoded JSON. It steals browser credentials from Chrome, Brave, and Edge SQLite login databases. Persistence is achieved via Registry Run key (Windows), LaunchAgent (macOS), or systemd user service (Linux). Supported commands include: kill, minicfg (reconfigure C2 and beacon interval), startup (install persistence), and runscript (execute PowerShell or shell scripts). A Domain Generation Algorithm generates 10 algorithmic .com domains every 5 days as fallback C2. Configuration is encrypted with AES-128-GCM using hardcoded key 'i am botking'. Commands are authenticated via an embedded RSA-2048 private key. The attack infrastructure overlaps with DPRK-attributed campaigns: the /49890878 C2 endpoint was used in the Mastra campaign (attributed to Sapphire Sleet), shared SSL issuer with Mastra infrastructure, victim-reported C2 IP 23.254.167[.]216 appears in UNC1069's axios npm attack analysis, and both campaigns use the 23.254.164.0/23 Hostwinds LLC IP range. The maintainer's machine or credentials were assessed as compromised. arrayref is found in over 35% of all environments and in 75% of environments where Rust is present.
1. Check lockfiles and local cache: search Cargo.lock across repositories for malicious versions and attacker-controlled crate names. Run: find ~/.cargo/registry/cache -type f matching arrayref-0.3.10.crate, internment-0.8.7.crate, append-only-vec-0.1.9.crate, proc-macro1-*.crate, proc-macro-en-*.crate, aovine-*.crate, arone-*.crate, aronenao-*.crate, tinymember-*.crate. 2. Treat affected hosts as compromised: any developer workstation or CI runner that built an affected project must be treated as compromised. Rotate every credential, token, and key reachable from it, including CI secrets and signing keys, and rebuild any artifacts produced after exposure from clean sources. 3. Rotate browser-stored credentials: the payload reads saved logins and extension data from Chrome, Brave, and Edge profiles. Reset those passwords and revoke associated sessions. 4. Remove payload and persistence artifacts: delete /tmp/rust-setup, %TEMP%\rust-setup.ps1, and %TEMP%\rust-setup-launch.vbs where present. Check for unrecognized systemd user services, HKCU Run entries, and LaunchAgents. Re-deploy affected workloads from a known clean state. 5. Do not resolve yank warnings by upgrading blindly: treat a sudden yank of multiple stable versions of a long-lived crate as a signal to investigate. 6. Review build-time dependencies: build scripts execute with full user privileges during compilation. Review any new or changed build-dependencies entries, particularly networking crates such as ureq, reqwest, or rustls in a crate with no reason to make network calls. 7. Review the Wiz Threat Intel Center advisory at https://app.wiz.io/boards/threat-center/wiz-adv-2026-151.
arrayref@0.3.10 (hijacked release), internment@0.8.7 (hijacked release), append-only-vec@0.1.9 (hijacked release), proc-macro1 (typosquat, all versions deleted), proc-macro-en (attacker-controlled, all versions deleted), aovine (attacker-controlled, all versions deleted), arone (attacker-controlled, all versions deleted), aronenao (attacker-controlled, all versions deleted), tinymember (attacker-controlled, all versions deleted), SHA256: 25ad700976873c76af785cb99b33c48db7df8b81f21d1e9e06b3676b9a9373ae (arrayref-0.3.10.crate), SHA256: 61198155da51b838772eecf5bfaac6cbc4dcc388dccc56658fc28a8e831b34d4 (proc-macro1-1.0.107.crate), SHA256: b5c1b5b0763a8809a644a8f92224653f0aca623a98eecc714d27f74b80fbe436 (proc-macro1-1.0.106.crate), SHA1: f22e3e01e38bcdf001f0d15a2dbfdec5a1cf8eff (proc-macro1-1.0.107.crate), SHA1: f4767ad92cb61401fd69139cade563501c39b991 (rust-crate_0.1.0, Linux stage-2 payload), SHA1: fc0fdb978eac72f4484b48db058e4473f1bc516e (rust-crate_0.2.0, Windows stage-2 payload), SHA1: ff7e20cf642346bf893f1eca808df82035bb53d0 (rust-crate_0.4.0, macOS arm64 stage-2 payload), IP: 23.254.165[.]112:9089 (Stage-2 payload host, Hostwinds VPS), IP: 23.254.165[.]112:443 (C2 address passed to payload as argv[1]), IP: 23.254.167[.]107:443 (Stage-2 C2, live at publication), IP: 23.254.167[.]216 (victim-reported C2), Domain: hwsrv-798836.hostwindsdns[.]com (attacker infrastructure hostname), Network: POST /49890878 (Stage-2 C2 request path), File: /tmp/rust-setup (Stage-2 payload, Unix), File: %TEMP%\rust-setup.ps1 (Stage-2 payload, Windows), File: %TEMP%\rust-setup-launch.vbs (hidden Windows launcher, executed via wscript.exe), Binary: rust-crate_0.1.0 / _0.2.0 / _0.3.0 / _0.4.0 (platform-specific stage-2 payloads), Account: dtolney (impersonation account, publisher of proc-macro1), Account: droundy (legitimate maintainer, machine or credentials likely compromised), Email: rchaitm@gmail[.]com (forged author metadata in proc-macro1), SSL Issuer: WIN-A6QF8AHPQH1\Administrator@WIN-A6QF8AHPQH1, Encryption key: 'i am botking' (AES-128-GCM hardcoded key)
