Somebody published poisoned versions of three widely used Rust packages on August 20, and simply compiling a project that pulled one of them in was enough to hand over the machine. Wiz Research reports that arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 each shipped with a hidden extra dependency whose build script downloaded and ran a remote payload. No developer had to run anything. The build did it for them.
The reach is what makes this one uncomfortable. Wiz says arrayref can be found in over 35% of all environments it sees, and that it is used in three quarters of all environments where Rust is present at all.
A dependency that had never changed in ten years
Each hijacked release added a single line to its manifest: a dependency on proc-macro1, a typosquat of the legitimate proc-macro2 crate, which has been downloaded more than 154 million times. Wiz notes that it was the first dependency arrayref had taken on in its ten year history. The malicious logic sat in that package's build script, and because Cargo runs build scripts at compile time, the payload fired during an ordinary build while the package itself carried on working normally.
At compile time the script rebuilt a command server address out of Base64 fragments, switched off TLS certificate validation using a verifier that accepted anything, fetched a payload matching the host operating system and architecture, and ran it.
What actually lands on the machine
Wiz Research analyzed the second stage, retrieved from Google Threat Intelligence, and describes a featureful backdoor rather than a smash and grab. It beacons over HTTPS, sending host information and stolen credentials as Base64 encoded JSON. It steals saved browser logins from Chrome, Brave and Edge by querying their SQLite login databases. It persists through a Registry Run key on Windows, a LaunchAgent on macOS or a systemd user service on Linux, and accepts four commands, one of which downloads and runs further scripts. If the primary server is unreachable it falls back to a domain generation algorithm that produces ten .com domains every five days, none of which are currently registered.
Why North Korea keeps coming up
Wiz stops short of formal attribution and instead sets out infrastructure overlaps, which are substantial. The payloads beacon to the request path /49890878, the same endpoint used in the Mastra campaign that Microsoft attributes to the North Korean cluster it calls Sapphire Sleet. The beacon address shares an unusual SSL certificate issuer with a second IP used in that campaign. A victim reported command traffic to 23[.]254[.]167[.]216, an address that appears in Google Cloud Threat Intelligence's analysis of UNC1069's attack on the axios npm package, activity Mandiant links to North Korea. Both campaigns lean on the same 23[.]254[.]164[.]0/23 range of Hostwinds infrastructure.
That direction of travel is familiar. Google's threat intelligence team reported last month that attackers have largely swapped vendor breaches for poisoned open source packages, which cost less to pull off and travel just as far.
Treat any machine that built it as compromised
The Rust Security Response Team deleted the malicious versions and locked the account, and assesses that the maintainer's machine or credentials were compromised. Wiz's guidance is blunt, and it follows from where the code ran: because the payload executes during cargo build, any developer workstation or CI runner that built an affected project should be treated as compromised. Search your Cargo.lock files for the three hijacked versions and the six attacker controlled crate names, rotate every credential, token and signing key reachable from that host, reset the passwords its browsers had saved, then delete the dropped payload and its persistence entries and rebuild affected artifacts from clean sources. Wiz also flags the reflex this attack was designed to exploit: the crew used yanking to push people into upgrading, so a sudden yank across several stable versions of a long lived crate is a reason to look closer rather than to upgrade blindly.
Indicators
- Hijacked releases: arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9
- Attacker controlled crates: proc-macro1, proc-macro-en, aovine, arone, aronenao, tinymember
- Payload host: 23[.]254[.]165[.]112 on ports 9089 and 443
- Stage two command server, live at publication: 23[.]254[.]167[.]107:443
- Beacon path: POST /49890878
- Dropped files: /tmp/rust-setup, rust-setup.ps1 and rust-setup-launch.vbs in the Windows temp folder
The full technical write up and the complete indicator table are in Wiz Research's report.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.