arrayref Rust Crate Hijacked in Supply Chain Attack With DPRK Infrastructure Overlap
Do Son 
At a Glance
| Actor | Unattributed; infrastructure overlaps with DPRK-linked activity (Wiz) |
| Activity | Software supply chain attack via poisoned Rust crates and a typosquatted dependency |
| Targets | Rust developers, CI/CD runners, and build systems that resolved the bad versions |
| Scale | arrayref appears in over 35% of environments; three crates live for roughly 86 to 107 minutes |
| Status | Malicious versions deleted; maintainer account locked; no charges announced |
| Source | Rust Security Response Team, Wiz, Socket |
TL;DR
On August 20, 2026, attackers published poisoned versions of three Rust crates to crates.io. The Rust supply chain attack hit arrayref, internment, and append-only-vec. Each pulled in a typosquatted dependency that ran malware during compilation.
What Happened
The attack centered on a fake crate called proc-macro1. It typosquats the legitimate proc-macro2, which has over 154 million downloads. Its build script carried the malicious logic.
The poisoned crates simply added one line to their manifest. Per Wiz, proc-macro1 was “the first dependency added to arrayref in its ten-year history”. Because Cargo runs build scripts at compile time, a normal build triggered the payload.
The three legitimate crates were live only briefly. Rust’s records show arrayref was online for 86 minutes. The team deleted the malicious versions and locked the account.
How the Payload Worked
The build script rebuilt a C2 address from Base64 fragments. It then disabled TLS certificate checks and downloaded a platform-specific binary. Finally, it wrote the file to a temp path and ran it.
The second stage is a full backdoor. Wiz reports it beacons over HTTPS and steals host details. It also enumerates saved logins in Chrome, Brave, and Edge, and installs persistence.
Who Is Behind It
No group is named or charged, and attribution stays careful. Wiz reports that the arrayref infrastructure “substantially overlaps with operations attributed to recent North Korean actors”.
The overlap is concrete. The payload beacons to an endpoint also seen in the DPRK-linked Mastra campaign. A victim-reported IP appears in analysis of a North Korean npm attack. Both campaigns favor the same Hostwinds address range.
The Rust team is careful about the maintainer, too. It does not believe the author acted maliciously. Instead, it assesses that their machine or credentials were compromised.
Impact and Scale
The reach is wide, though exposure is narrower. Socket notes that arrayref is deeply embedded in Rust’s dependency tree. RustSec counts roughly 152 million downloads for the prior clean release.
Download counts do not equal compromised hosts, however. Exposure depends on whether a system actually built a bad version. The real risk sits with developer machines, CI/CD runners, and release infrastructure that hold secrets.
How to Stay Protected
Check your lockfiles and caches first. Search Cargo.lock and Cargo caches for the three poisoned versions and the attacker crate names. Details appear in the Rust Security Response Team advisory.
Pin the clean releases: arrayref 0.3.9 or lower, internment 0.8.6 or lower, and append-only-vec 0.1.8 or lower. For deeper technical detail, see the Wiz analysis of the DPRK overlap and Socket’s breakdown of the compromised crates.
If a system built a bad version, treat it as compromised. Hunt for the dropped files and new user-level persistence. Then rotate any secrets reachable from that build environment and rebuild from a clean host.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
