Supply-chain attack hits Rust crate "arrayref" with malicious releases

Odaily Planet Daily reported that on Aug. 20, attackers published malicious versions of three widely used Rust packages in a supply-chain attack. One of them, arrayref, is used in roughly three-quarters of Rust development environments. The tainted releases hid a backdoor designed to automatically steal login credentials during project compilation. Users who built projects with the affected versions may have had their computers and cryptographic keys compromised. Wiz researchers said the command-and-control infrastructure tied to the arrayref incident overlaps with activity attributed to North Korean hacking groups Sapphire Sleet and UNC1069's Mastra operation, citing shared IP addresses, security certificates and the same hosting provider, Hostwinds. The attackers did not alter the original code. Instead, they added a misspelled dependency, procmacro1, intended to resemble the commonly used procmacro2, enabling the malicious versions to pass tests and builds. The malicious packages were removed 86 minutes after publication, though they had already been downloaded widely. The affected crates are broadly used across tooling in the Solana and Ethereum ecosystems. The Rust team said it does not believe the maintainers acted maliciously and that their devices or credentials were likely compromised.