North Korean Hackers Strike at Rust Ecosystem with Sophisticated Supply Chain Attack
In a brazen and well-planned attack, North Korean hackers have compromised one of the most popular open source software (OSS) projects in the world. The target was the Rust ecosystem, specifically the arrayref crate, an essential utility for converting arrays that has been downloaded over 245 million times. The malicious package was pushed to crates.io from a legitimate maintainer’s account just 20 minutes before two other poisoned crates were released.
The hackers’ plan involved creating typosquatted versions of a legitimate dependency, proc-macro2, and an impersonating account. This allowed them to hide a malicious file called build.rs within the dependency, which would fetch a platform-specific second-stage binary over TLS after disabling certificate validation. The goal was clear: to infect Rust environments with malware.
The attack has been linked to Sapphire Sleet, a North Korean threat actor responsible for previous supply chain attacks on NPM packages Axios and Mastra in April and June. Wiz’s analysis shows that the attackers planned each step with precision, using similar infrastructure overlaps across all three incidents. The arrayref payloads beaconed to an endpoint used in the Mastra attack, while command-and-control (C&C) traffic was recorded to an IP used in the Axios campaign.
Fortunately, the Rust Security Response Team was quick to respond and removed the malicious packages just 86 minutes after they were published. While it appears that no actual usage of the compromised crates occurred, the team has not ruled out the possibility that the legitimate maintainer’s computer or credentials may have been compromised. The team is attempting to contact the maintainer to verify their account.
The attack highlights the ongoing threat posed by sophisticated supply chain attacks. Hackers are increasingly targeting open source software projects, which can be notoriously difficult to secure due to their collaborative nature and reliance on external dependencies. As we’ve seen in recent months, attackers are becoming more brazen and well-planned in their efforts to compromise critical infrastructure.
For users of the Rust ecosystem, this attack serves as a stark reminder of the importance of vigilance and proactive security measures. To avoid falling victim to similar attacks, it’s essential to stay informed about potential vulnerabilities and keep your dependencies up-to-date. Regularly review your package versions and watch for suspicious activity in your environments.
As we navigate the complex world of open source software, one thing is clear: the threat landscape continues to evolve at an alarming pace. By staying informed and taking proactive measures, we can reduce our exposure to these types of attacks.
Source: SecurityWeek — 2026-08-21