A threat actor compromised the maintainer account behind arrayref, a popular Rust library used in cryptography, graphics, and blockchain projects, to push malware that executes during compilation on developers’ machines.
The attack also poisoned two related crates, append-only-vec and internment, within a 23-minute window. All three were maintained by the same compromised account.
The malicious releases were arrayref 0.3.10, append-only-vec 0.1.9, and internment 0.8.7. The attacker injected a dependency on a package called proc-macro1, a typosquat mimicking the legitimate proc-macro2 crate. The rest of the upstream source code remained unchanged.
A build script in proc-macro1 runs automatically during compilation. It reconstructs its infrastructure from base64-encoded fragments and selects a payload matching the host operating system: Linux x86-64, Windows x86-64, macOS x86-64, or macOS ARM64.
Platform-Specific Execution
On Unix systems, the malware writes to /tmp/rust-setup, marks the file executable, and launches it as a detached process. On Windows, it creates %TEMP%setup.ps1 and uses a hidden wscript.exe and VBS launcher to maintain execution. The payload receives an address as an argument, likely a command-and-control server.
ust-
Second-Stage Capabilities
According to analysis from cloud security firm Wiz, second-stage capabilities include exfiltrating host information and credentials. The malware targets login databases from Google Chrome, Brave, and Microsoft Edge browsers, querying them through SQLite. Persistence mechanisms vary by platform: Registry Run keys on Windows, LaunchAgent on macOS, and systemd on Linux.
Four additional crates published by the attacker—aovine, arone, aronenao, and tinymember—have been removed from crates.io.
Affected Projects and Scope
The potential scope is substantial. Arrayref alone has over 245 million lifetime downloads and more than 53 million in the past 90 days. The combined download count for append-only-vec and internment approaches 19 million. Affected projects include the blake3 hashing library, Rust GUI frameworks such as egui, eframe, and iced, and components used in Ethereum and Solana development.
North Korean ties have been identified. Wiz researchers note the campaign’s infrastructure overlaps with previously documented North Korean supply-chain attacks, including those targeting the Mastra and axios ecosystems.
Recommendations
Developers who installed any of the affected packages during the exposure window of roughly 90 minutes should treat their environments as compromised. Recommended actions include checking Cargo.lock files for the malicious packages, searching for the dropped files on affected systems, and reviewing network traffic to 23.254.165.112 on ports 9089 and 443.
Where compromise is confirmed, all accessible credentials, CI tokens, signing keys, and other secrets should be rotated. Environments should be rebuilt from known-safe backups. Projects not yet affected should pin verified-healthy versions of these dependencies until the maintainer situation is resolved.