Rust Ecosystem Supply-Chain Attack Targeting arrayref

Executive Summary

On August 20, 2026, attackers hijacked a prominent Rust ecosystem crate and pushed a malicious update to arrayref@0.3.10, a small array-conversion utility with approximately 245 million lifetime downloads and use in roughly 75% of Rust environments. The malicious release was published from the compromised crates.io account of maintainer David Roundy, under the droundy account, at 07:15 UTC. The attacker injected a new dependency on the typosquatted crate proc-macro1, impersonating the legitimate proc-macro2 crate. The malicious proc-macro1@1.0.107 contained a build.rs script that downloaded and executed a second-stage payload during Cargo builds.

Within 23 minutes, the same compromised maintainer account published poisoned versions of two additional crates, internment@0.8.7 and append-only-vec@0.1.9. Earlier, the attacker had seeded attacker-owned crates including aovine, arone, aronenao, tinymember, and proc-macro-en with the same malicious build logic. The attacker also created a fake GitHub account named dtolney, impersonating David Tolnay's legitimate dtolnay handle, and used it to publish the clean decoy proc-macro1@1.0.106 before publishing the malicious 1.0.107 release.

The second-stage payload targeted developer and build environments across Linux, Windows, and macOS. It downloaded an OS-specific binary, established persistence, harvested local information and Chromium-based browser data, and communicated with a command-and-control server over HTTPS. The malware supported commands for termination, configuration changes, persistence installation, and arbitrary script execution. It also used a Domain Generation Algorithm as a fallback when the primary C2 was unavailable.

The Rust Security Response Team removed the malicious packages within approximately one to two hours of publication. arrayref@0.3.10 was downloaded 2,285 times before removal, and the Rust team reported no evidence that any end-user environments were actually infected. Nevertheless, the incident demonstrated that a trusted package registry, compromised maintainer credentials, and automatic build-script execution can provide a direct path from a poisoned dependency to developer and CI environments. Multiple security analysts attributed the campaign with high confidence to a North Korea-linked actor, likely Sapphire Sleet, also tracked as UNC1069 by Mandiant.

Verification of Claims

1. Claim: arrayref@0.3.10 was maliciously published from the compromised droundy crates.io account.

   → Verified

   → The source states that the release was published by the arrayref maintainer's compromised account at 07:15 UTC and that the Rust Security Response Team determined the maintainer's computer or credentials were likely compromised.

2. Claim: The malicious arrayref release introduced a dependency on the typosquatted proc-macro1 crate.

   → Verified

   → The source states that arrayref@0.3.10 added proc-macro1 = "1.0.107" and that proc-macro1 impersonated the legitimate proc-macro2 crate.

3. Claim: proc-macro1@1.0.107 contained a malicious build.rs script that downloaded and executed a second-stage payload.

   → Verified

   → The source's technical analysis describes the malicious build script, its hard-coded C2 URL, OS-specific payload download, and execution behavior.

4. Claim: internment@0.8.7 and append-only-vec@0.1.9 were poisoned through the same compromised maintainer account.

   → Verified

   → Registry chronology in the source records both malicious publications from the same attacker-controlled account within 23 minutes of arrayref.

5. Claim: The attacker had previously seeded attacker-owned crates with the same malicious build logic.

   → Verified

   → The source identifies aovine, arone, aronenao, tinymember, and proc-macro-en as attacker-owned crates carrying the same malicious build logic.

6. Claim: The Rust Security Response Team removed the malicious packages within approximately one to two hours.

   → Verified

   → Registry chronology records deletion of proc-macro1 at 08:03 UTC and removal of the poisoned packages between 08:41 and 09:25 UTC.

7. Claim: arrayref@0.3.10 received 2,285 downloads before removal.

   → Verified

   → RustSec and the source report approximately 2,285 downloads.

8. Claim: End-user environments were actually infected by the malicious crates.

   → Unverified / Not supported by available evidence

   → The Rust team reported no evidence that any end-user environments were actually infected and no confirmed downstream compromises.

9. Claim: The campaign was conducted by a North Korea-linked actor, likely Sapphire Sleet / UNC1069.

   → Partially verified

   → Multiple security analysts attributed the activity with high confidence based on infrastructure overlap, including the C2 endpoint and SSL certificates matching infrastructure associated with Microsoft-attributed DPRK attacks. The source identifies Sapphire Sleet and UNC1069 as the likely attribution rather than presenting direct identification of the individual operators.

10. Claim: The malicious payload stole credentials and browser information.

    → Verified

    → The technical analysis states that the backdoor harvested host and user information, credentials, Chromium browser login databases, URLs, usernames, and potentially browser extension storage.

11. Claim: The attack caused confirmed downstream data theft or business losses.

    → Unverified / Not supported by available evidence

    → The source reports no confirmed downstream compromises, stolen-data disclosures, or publicly reported business or financial losses.

12. Claim: The maintainer acted maliciously.

    → Unverified / Not supported by available evidence

    → The Rust team stated that they did not believe the author of arrayref was acting maliciously and that the author's computer or credentials were likely compromised.

Timeline

Attack Anatomy

Initial Access

The initial compromise of the maintainer's crates.io/GitHub credentials is not known. The source states that the account takeover may have involved phishing or credential theft, but does not establish the exact initial-access method. The attacker subsequently used the compromised droundy account to publish malicious versions of legitimate crates.

Execution

The primary execution mechanism was Rust's Cargo build process. The attacker added proc-macro1 = "1.0.107" as a dependency to arrayref. During a normal Cargo build, the malicious dependency's build.rs script was automatically compiled and executed. The script reconstructed a hard-coded URL from Base64 fragments, disabled TLS certificate validation, downloaded an OS-specific second-stage payload, and launched it.

On Windows, the payload used a hidden VBScript launcher to start the PowerShell payload while escaping Cargo's job so that it could run detached. On Unix and macOS, the payload was written to /tmp/rust-setup and made executable.

Persistence

The second-stage backdoor supported a startup command that installed persistence. On Windows, it created a Registry Run key. On macOS, it created a LaunchAgent plist. On Linux, it installed a systemd user service.

Collection

The backdoor collected host and user information and credentials. It enumerated installed applications and read Chromium-based browser SQLite login databases from Chrome, Brave, and Edge to obtain saved URLs and usernames. Wiz noted that encrypted passwords were not directly retrieved. The malware could also collect browser extension storage, likely targeting cryptocurrency wallets.

Exfiltration

The malware communicated with its C2 infrastructure through HTTPS POST requests to /49890878, exfiltrating host information and credentials. The payload received the C2 address as a command-line argument. If the primary C2 was unavailable, a Domain Generation Algorithm generated ten pseudorandom .com domains every five days as backup infrastructure.

Implant internals

Wiz's reverse engineering established three design details that distinguish this implant from commodity infostealers and are worth recording precisely, because each one is a detection or attribution opportunity:

• Configuration encryption. The implant's configuration blob is encrypted with AES-128-GCM under the hard-coded key string i am botking. A hard-coded symmetric key of that length is a strong static-detection anchor and appears reusable across builds of the same family.
• Authenticated commands. Tasking is authenticated against an embedded RSA-2048 private key, meaning the operators can prove command authorship to the implant. This prevents defenders (and rival actors) from taking over a beacon simply by pointing it at a fake C2 — a level of care not typical of opportunistic crimeware.
• Command set. Four verbs: kill (terminate), minicfg (rewrite C2 address and beacon interval), startup (install OS-appropriate persistence), and runscript (execute an arbitrary PowerShell or shell script). runscript makes this a general -purpose backdoor rather than a stealer — the credential theft is the first action, not the limit of what the operators can do.

Impact

The attack exposed Rust developers and CI environments that built affected packages during the exposure window. arrayref@0.3.10 was downloaded 2,285 times before removal. The three affected legitimate crates had approximately 264 million combined lifetime downloads, although the source does not state that all of those environments were exposed or compromised. Rust and security teams reported no confirmed downstream compromises.

Threat Actor Profile

• Name / Alias: Sapphire Sleet, also tracked as UNC1069 by Mandiant. The source states that multiple security analysts attribute the campaign to this North Korea-linked actor.
• Attribution Confidence: High. Wiz and other researchers identified infrastructure overlap between the arrayref C2 endpoint and SSL certificates used in Microsoft-attributed DPRK attacks, including the Mastra npm supply-chain compromise. Google/Mandiant analysis of the April 2026 Axios compromise and Microsoft and Amazon Threat Intelligence reporting were also cited as supporting the attribution.
• Motivation: Espionage. The source states that the group's known motives include cyber-espionage and theft of credentials from the financial and cryptocurrency sectors.
• Sophistication Level: Advanced. The operation combined maintainer-account compromise, typosquatting, dependency poisoning, build-time execution, OS-specific payload delivery, TLS validation bypass, detached execution, credential and browser-data theft, multiple persistence mechanisms, HTTPS C2, encrypted configuration, command authentication, and Domain Generation Algorithm fallback infrastructure.
• Known Previous Operations: The source links the infrastructure to the Mastra npm supply-chain compromise and the April 2026 Axios compromise attributed to UNC1069. Microsoft and Amazon Threat Intelligence publications were cited as linking those prior campaigns to Sapphire Sleet/UNC1069.
• Nation-State Nexus: Yes. The source identifies the likely actor as North Korea-linked and states that multiple threat-intelligence organizations attribute the related infrastructure and previous campaigns to DPRK state-sponsored activity.
• MITRE ATT&CK Techniques:
  • T1195.002 — Compromise Software Supply Chain
  • T1078 — Valid Accounts
  • T1059.005 — Command and Scripting Interpreter: Visual Basic
  • T1059.004 — Command and Scripting Interpreter: Unix Shell
  • T1071.001 — Application Layer Protocol: Web Protocols
  • T1483 — Domain Generation Algorithms
  • T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
  • T1547.002 — Boot or Logon Autostart Execution: Authentication Package
  • T1547.004 — Boot or Logon Autostart Execution: Winlogon Helper DLL
  • T1005 — Data from Local System
  • T1041 — Exfiltration Over C2 Channel
  • T1566 — Phishing [possible initial-access technique; exact method is unknown]
• Operational Security (OpSec): The attacker used a compromised legitimate maintainer account and typosquatted developer identities, while the C2 infrastructure and SSL certificates overlapped with infrastructure associated with previous DPRK campaigns. The reuse of infrastructure created attribution opportunities for security researchers. The attacker nevertheless operated the malicious packages for only a limited period before detection and removal.

Technical Indicators

domains:
  - "hwsrv-798836[.]hostwindsdns[.]com"
ip_addresses:
  - "23[.]254[.]165[.]112"
  - "23[.]254[.]167[.]107"
  - "23[.]254[.]167[.]216"
file_hashes:
  - type: sha256
    value: "25ad700976873c76af785cb99b33c48db7df8b81f21d1e9e06b3676b9a9373ae"
    description: "arrayref-0.3.10.crate"
  - type: sha256
    value: "61198155da51b838772eecf5bfaac6cbc4dcc388dccc56658fc28a8e831b34d4"
    description: "proc-macro1-1.0.107.crate"
  - type: sha256
    value: "b5c1b5b0763a8809a644a8f92224653f0aca623a98eecc714d27f74b80fbe436"
    description: "clean proc-macro1-1.0.106 decoy crate"
urls:
  - "hxxps://23[.]254[.]165[.]112:9089/"
  - "hxxps://23[.]254[.]165[.]112:443/49890878"
c2_infrastructure:
  - "23[.]254[.]165[.]112:9089, used to serve the second-stage payload"
  - "23[.]254[.]165[.]112:443/49890878, used for HTTPS C2"
  - "23[.]254[.]167[.]107:443, live C2 observed by Wiz"
  - "23[.]254[.]164[.]0/23 Hostwinds LLC infrastructure range"
  - "Ten pseudorandom .com domains generated every five days through the malware's Domain Generation Algorithm"
package_identifiers:
  - "arrayref@0.3.10"
  - "internment@0.8.7"
  - "append-only-vec@0.1.9"
  - "proc-macro1@1.0.107"
  - "proc-macro1@1.0.106"
  - "proc-macro-en"
  - "aovine"
  - "arone"
  - "aronenao"
  - "tinymember"
file_paths:
  - "/tmp/rust-setup"
  - "%TEMP%\\rust-setup.ps1"
  - "rust-setup-launch.vbs"

Legal and Regulatory Response

Law Enforcement Actions

No law enforcement actions or indictments have been announced in relation to this incident.

Government Directives

No government advisory or directive specifically mentioning this Rust crate incident was reported in the source.

Platform Response

The Rust Security Response Team and crates.io rapidly removed the malicious packages and locked the compromised accounts. proc-macro1 and proc-macro-en were deleted, followed by the poisoned arrayref, internment, and append-only-vec versions. The attacker and maintainer accounts were locked, and clean versions of the affected crates were un-yanked.

Security researchers also reported the compromise to RustSec, including advisory-db entry #3161, and published technical analyses and indicators.

Criminal Proceedings

No indictments or other criminal proceedings related to this incident were announced in the source.

Impact Assessment

• arrayref@0.3.10 downloads: Confirmed: 2,285 downloads before the malicious release was removed.
• Exposure duration of arrayref@0.3.10: Confirmed: Approximately 86 minutes.
• Exposure duration of internment@0.8.7: Confirmed: Approximately 90 minutes.
• Exposure duration of append-only-vec@0.1.9: Confirmed: Approximately 107 minutes.
• Combined lifetime downloads of affected legitimate crates: Reported: Approximately 264 million downloads across arrayref, internment, and append-only-vec.
• Potentially exposed developer machines or CI runners: Estimated: Potentially thousands of machines or runners that built Rust code during the August 20 exposure window.
• Confirmed downstream compromises: Confirmed: None reported by Rust and security teams.
• Credentials and tokens: Potential impact: In an infected environment, the malware could steal credentials and tokens, including browser-stored information and potentially cryptocurrency-wallet-related browser extension data. No confirmed downstream theft was attributed to this incident.
• Developer ecosystem impact: Reported: The incident demonstrated that trusted Rust packages and the Cargo build process remain vulnerable to software supply-chain compromise.
• Business or financial losses: Unknown: No business or financial losses were publicly reported. The source identifies possible indirect costs such as cleanup time and loss of trust.
• Maintainer impact: Reported: The maintainer was treated as a victim, with the Rust team stating that they did not believe the author acted maliciously and that the author's computer or credentials were likely compromised.

Lessons and Defensive Recommendations

For Security Teams / SOC Analysts:

• Monitor Rust package dependencies and build behavior for unexpected changes, especially newly introduced dependencies in mature crates.
• Monitor Cargo build scripts for network activity and unexpected process execution.
• Use allowlisting and build-time monitoring to identify packages that attempt outbound network connections during compilation.
• Apply network egress controls to developer workstations and CI runners so build processes cannot freely contact arbitrary external infrastructure.
• Check local Cargo caches for deleted or yanked malicious package versions, as advised by the Rust team's official response.
• Hunt for the published IP addresses, C2 endpoint, malicious package versions, payload file paths, and SHA256 hashes.
• Monitor for /tmp/rust-setup, %TEMP%\rust-setup.ps1, and rust-setup-launch.vbs on potentially affected systems.
• Monitor browser databases, browser-extension storage, and credentials for suspicious access following exposure to the malicious crates.

For Developers and Architects:

• Review dependency changes carefully, particularly unexpected new dependencies in long-established packages.
• Treat build scripts as executable code with the same security implications as application code.
• Avoid allowing untrusted build processes unrestricted network access.
• Use reproducible builds and dependency controls where possible to detect unexpected package modifications.
• Review and verify maintainer and package identities before accepting suspicious dependency names, particularly typosquatted packages such as proc-macro1 versus proc-macro2.
• Regularly audit cached and resolved dependency versions in development and CI environments.

For Platform / Cloud Providers:

• Strengthen monitoring for suspicious maintainer-account activity, including unexpected publication patterns and rapid yanking of existing versions.
• Detect typosquatted packages that impersonate highly popular dependencies.
• Monitor newly published packages for malicious build.rs behavior and unexpected network connections.
• Rapidly remove confirmed malicious packages and lock compromised accounts.
• Improve supply-chain telemetry and package-level behavioral analysis to identify payload delivery through build scripts.
• Provide mechanisms for maintainers to secure and recover compromised accounts quickly.

For Leadership / CISO:

• Treat software package registries and developer accounts as critical supply-chain assets.
• Recognize that a trusted dependency can become an execution path into developer and CI environments without exploiting a vulnerability in the application itself.
• Require strong authentication and protection for accounts capable of publishing software packages.
• Establish policies governing dependency approval, package provenance, build isolation, and outbound network access from CI systems.
• Include software supply-chain compromise in incident-response planning and ensure teams can quickly determine whether malicious package versions were pulled or executed.
• Consider the reputational and ecosystem-wide consequences of compromised maintainers while distinguishing malicious actors from maintainers whose accounts or systems were compromised.

Sources

1. Rust Security Response WG. "Supply chain attack on arrayref". The Rust Programming Language Blog, 20 August 2026. Primary source for the official incident timeline and response actions.
2. RustSec Advisory Database. RUSTSEC-2026-0260 (arrayref), RUSTSEC-2026-0262 (append-only-vec), and the full advisory index. 20 August 2026.
3. Wiz Research. "Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns". 20 August 2026. Primary source for implant reverse engineering, IoCs, and DPRK infrastructure overlap.
4. StepSecurity. "Rust Supply-Chain Attack: arrayref, internment, and append-only-vec Poisoned by the proc-macro1 Build-Time Dropper". 20 August 2026.
5. Socket. "Popular Rust Crates Compromised in Build-Time Supply Chain Attack". 20 August 2026.
6. SafeDep. "Malicious Rust Crate arrayref Runs a Build-Time Payload". 20 August 2026.
7. Semgrep. "Rust Crates arrayref & append-only-vec Compromised". 20 August 2026.
8. The Hacker News. "Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads". August 2026.
9. Intrudify. "arrayref: 86 Minutes of Compromise". August 2026.
10. SecurityWeek. "Rust Supply Chain Attack Linked to North Korean Hackers". August 2026.
11. MITRE ATT&CK. Enterprise Matrix — technique IDs verified against the live technique pages.

Corrections log — 1 September 2026: All citations relinked to primary sources. IoC block extended with the live C2 (23[.]254[.]167[.]107) and the Hostwinds DNS name documented by Wiz but absent from the original draft. Added an implant-internals subsection covering the AES-128-GCM configuration key, RSA-2048 command authentication, and the four-verb command set.