Malicious versions of three Rust packages, including the widely used arrayref, were published to the crates.io registry on August 20, carrying a backdoor that executed automatically when affected projects were compiled.
Security researchers at Wiz said the attack also shares infrastructure with recent supply-chain campaigns attributed to North Korean threat actors.
The compromised releases were “arrayref@0.3.10”, “internment@0.8.7,” and “append-only-vec@0.1.9.” All three introduced a dependency on “proc-macro1,” a typosquat of the legitimate and widely downloaded “proc-macro2” crate.
The malicious dependency contained a build script that downloaded and executed a second-stage payload during compilation, Wiz researchers said in a blog post. “The second stage payload is selected based on the platform, with support for x86_64 versions of Linux, Windows, and macOS, in addition to aarch64 macOS,“ they added.
A StepSecurity analysis noted that arrayref has 245 million all-time downloads, with 53.7 million of them happening in the last 90 days. The cybersecurity outfit estimated per-crate exposure windows at 86, 90, and 107 minutes, respectively, before all of them were deleted along with other associated crates.
