Hackers Target Popular arrayref Rust Crate in Supply-Chain Attack

Security researchers are investigating a supply-chain attack against popular Rust crates, specifically targeting the arrayref crate with a malware designed to steal information. The attack involved compromising the maintainer account behind arrayref, a widely used package with over 245 million downloads, and introducing four additional attacker-owned crates.

This malicious activity was part of an elaborate campaign that also overlapped with supply chain efforts linked to North Korean nation-state actors. Once the attack was executed over a period of 23 minutes, the hackers poisoned two other crates from the same owner and published four other malicious crates - aovine, arone, aronenao, and tinymember - which were subsequently removed.

The attackers used a typosquatted dependency (proc-macro1) with a build script that downloaded and executed a remote payload, avoiding detection by leveraging the build script's execution during compilation. The hackers meticulously created a GitHub account that imitated Rust developer David Tolnay, arrayref maintainer, to establish a clean decoy and lure developers into updating their dependencies.

The build script reconstructed a command-and-control (C2) URL from Base64 fragments, disabled TLS certificate validation, and downloaded a malicious payload based on the host's operating system and architecture, exfiltrating sensitive data from the compromised system. The malware established persistence in Windows, macOS, and Linux systems and included four termination commands to evade detection.

The infrastructure used in this attack was found to overlap with recent North Korean supply-chain attacks, including a similar npm supply-chain attack on the Mastra framework, attributed to a group known as Sapphire Sleet.