{"id":4897,"date":"2026-08-21T19:07:37","date_gmt":"2026-08-21T19:07:37","guid":{"rendered":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/08\/21\/hackers-target-popular-arrayref-rust-crate-in-supply-chain-attack\/"},"modified":"2026-08-21T19:07:37","modified_gmt":"2026-08-21T19:07:37","slug":"hackers-target-popular-arrayref-rust-crate-in-supply-chain-attack","status":"publish","type":"post","link":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/08\/21\/hackers-target-popular-arrayref-rust-crate-in-supply-chain-attack\/","title":{"rendered":"Hackers Target Popular arrayref Rust Crate in Supply-Chain Attack"},"content":{"rendered":"
\"\"<\/div>\n

\"\"<\/p>\n

Security researchers are sorting through a complex, stealthy, and fast-moving supply-chain attack aimed at pushing information-stealing malware by compromising the account of the maintainer of multiple Rust crates and introducing four more attacker-owned crates.<\/p>\n

In addition, researchers with Wiz wrote that there also appears to be overlap with supply chain campaigns run by nation-state actors linked to the government of North Korea.<\/p>\n

According to multiple reports, unknown threat actors this week compromised the maintainer account behind arrayref, a widely used package with more than 245 million downloads that Sai Likhith, backend engineer with StepSecurity, described<\/a> as a \u201ctiny array-conversion utility\u201d that is \u201cone of the Rust ecosystem\u2019s quiet load-bearing crates.\u201d<\/p>\n

Over the next 23 minutes, as part of the same attack, the hackers poisoned two other crates from the same owner, append-only-vec and internment. In addition, the attackers published versions of four other crates \u2013 aovine, arone, aronenao, and tinymember \u2013 which have been removed from crates.io.<\/p>\n

Also, the releases published by the attacker \u2013 arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 \u2013 from the same compromised owner account, were removed. All were published with the same typosquatted dependency (proc-macro1), which came with a build script that downloaded and executed a remote payload.<\/p>\n

Avoiding Detection<\/h3>\n

\u201cBecause build scripts run during compilation, building an affected project was sufficient to execute the payload,\u201d Wiz researchers Rami McCarthy and Benjamin Read wrote in their report<\/a>. \u201carrayref can be found in over 35% of all environments. Even more notably, it\u2019s used in \u00be of all environments where Rust is present.\u201d<\/p>\n

The hackers put a lot of effort into keeping the attack below the radar. Two days before the malicious arrayref, append-only-vec, and internment releases were published, seven versions of arone and 11 of aronenoa were published, with both carrying malicious build scripts and both owned by the same account as tinymember, according to StepSecurity\u2019s Likhith.<\/p>\n

Five hours before the malicious arrayref, append-only-vec, and internment releases hit, the hackers created a GitHub account that impersonated that of Rust developer David Tolnay, the arrayref maintainer. The name on the typosquatted account was only one letter off from Tolnay\u2019s. It published proc-macro1@1.0.106, a full copy of the legitimate proc-macro2 source but without a build script. It essentially was a clean decoy, whose \u201csole purpose is to establish publishing history so the crate does not appear as a zero-history package during later inspection,\u201d Likhith wrote.<\/p>\n

Researchers wrote that it was likely Tolnay\u2019s computer or credentials were compromised.<\/p>\n

Yanking Legitimate Versions<\/h3>\n

The hackers, 24 seconds after publishing arrayref version 0.3.10 with the malicious dependency \u2013 the crate hadn\u2019t added a dependency in 10 years \u2013 yanked every legitimate version of arrayref@0.3.x \u2013 0.3.9, 0.3.8, 0.3.7, 0.3.6, 0.3.5 \u2013 four seconds apart, a move that he called \u201cthe upgrade lure.\u201d<\/p>\n

\u201cThe intended victim psychology is obvious: developers and CI maintainers see a scary new warning on a dependency with 152 million downloads, and the \u2018responsible\u2019 fix, cargo update -p arrayref, resolves to the single non-yanked modern release: 0.3.10,\u201d Likhith wrote. \u201cThe original reporter states this is exactly how they were hit. The attacker turned the registry\u2019s own safety feature into the delivery channel.\u201d<\/p>\n

Exfiltrating Data<\/h3>\n

According to Wiz\u2019s McCarthy and Read, at compile time, the build script reconstructs a command-and-control (C2) URL from Base64 fragments, disables TLS certificate validation using a custom AcceptAll verifier, and downloads a payload based on the operating system and architecture of the host, writing it to disk on Unix or Windows. It then executes the payload and passes the C2 beacon address.<\/p>\n

A backdoor beacons to the C2 and exfiltrates the host\u2019s information and stolen credentials. It collects the hostname, username, and operating details, checks the installed applications, reads Chromes, Brave, and Edge profiles looking for saved logins and extension settings, and queries the browsers\u2019 SQLite credential stores. The malware establishes persistence in the Windows, macOS, and Linux systems and includes four commands that terminate its work, reconfigures the C2 and beacon interval, installs persistence, and downloads and executes PowerShell or shell scripts.<\/p>\n

It \u201cfalls back to a Domain Generation Algorithm if the primary C2 is unreachable, generating 10 algorithmic .com domains every 5 days,\u201d they wrote.<\/p>\n

Links to North Korean Groups<\/h3>\n

McCarthy and Read also wrote that the infrastructure used to target arrayref \u201csubstantially overlaps\u201d with that of recent North Korean supply-chain attacks. The C2 endpoint used in the arrayref campaign was used in a npm supply-chain attack on open source Mastra framework outlined by Microsoft<\/a> and attributed to a group it calls Sapphire Sleet. The IP addresses found in both campaigns share an SSL issuer.<\/p>\n

In March, Google Threat Intelligence Group found that C2 traffic in a compromise of the Axios npm package<\/a> linked to UNC1069, another North Korea-nexus group used the same IP for C2 traffic<\/a> as did the arrayref hackers. There also is the same use of the Hostwinds infrastructure.<\/p>\n

Read More<\/a><\/p>\n

\u200b<\/p>","protected":false},"excerpt":{"rendered":"

Security researchers are sorting through a complex, stealthy, and fast-moving supply-chain attack aimed at pushing information-stealing malware by compromising the […]<\/p>\n","protected":false},"author":1,"featured_media":4898,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[5],"tags":[],"class_list":["post-4897","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"_links":{"self":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/4897","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/comments?post=4897"}],"version-history":[{"count":0,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/4897\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media\/4898"}],"wp:attachment":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media?parent=4897"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/categories?post=4897"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/tags?post=4897"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}