Backdoored Rust Packages Expose Developers to Malware During Compilation
On August 20, malicious versions of three Rust packages arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9 were published to the crates.io registry, embedding a backdoor that activated automatically during project compilation. The attack, discovered by security researchers at Wiz, exploited Rust’s build process, where the payload executed without requiring developers to run suspicious code or call affected functions.
The compromised packages introduced a dependency on proc-macro1, a typosquat of the legitimate proc-macro2 crate. During compilation, the build script reconstructed a command-and-control (C2) URL from Base64 fragments, disabled TLS validation, and downloaded a platform-specific payload for Linux, Windows, or macOS (including Apple Silicon). The malware collected system details, browser credentials (Chrome, Brave, Edge), and installed applications, while also establishing persistence via registry keys, LaunchAgents, or systemd services.
With arrayref alone recording 245 million all-time downloads (53.7 million in the last 90 days), the exposure window for affected versions lasted between 86 and 107 minutes before removal. The attack shares infrastructure with recent supply-chain campaigns linked to North Korean threat actors, including overlapping C2 paths and SSL certificate issuers tied to operations attributed to groups like Sapphire Sleet.
The payload featured a fallback domain-generation mechanism, creating 10 new .com domains every five days if the primary C2 became unavailable. Wiz recommended treating any developer workstation or CI runner that built affected projects as compromised, urging rotation of credentials, tokens, and keys, and rebuilding artifacts from clean sources.
crates.io TPRM report: https://www.rankiteo.com/company/rust-foundation
"id": "rus1787326693",
"linkid": "rust-foundation",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Developers and organizations '
'using affected Rust packages',
'industry': 'Software Development',
'location': 'Global',
'name': 'crates.io (Rust package registry)',
'size': 'Large (245M+ downloads for arrayref alone)',
'type': 'Open-source package registry'}],
'attack_vector': 'Compromised open-source packages (crates.io)',
'data_breach': {'data_exfiltration': 'Yes (to C2 server)',
'personally_identifiable_information': 'Browser credentials, '
'system details',
'sensitivity_of_data': 'High (credentials, PII)',
'type_of_data_compromised': 'Browser credentials, system '
'information, installed '
'applications'},
'date_detected': '2024-08-20',
'date_publicly_disclosed': '2024-08-20',
'description': 'Malicious versions of three Rust packages (arrayref@0.3.10, '
'internment@0.8.7, and append-only-vec@0.1.9) were published '
'to crates.io, embedding a backdoor that activated '
'automatically during project compilation. The attack '
'exploited Rust’s build process to execute a payload without '
'requiring developers to run suspicious code or call affected '
'functions. The malware collected system details, browser '
'credentials, and installed applications while establishing '
'persistence.',
'impact': {'brand_reputation_impact': 'Potential erosion of trust in '
'Rust/crates.io ecosystem',
'data_compromised': 'Browser credentials (Chrome, Brave, Edge), '
'system details, installed applications',
'identity_theft_risk': 'High (browser credentials, PII exposure)',
'operational_impact': 'Compromised development environments, '
'potential for further supply chain attacks',
'systems_affected': 'Developer workstations, CI runners, build '
'environments'},
'initial_access_broker': {'backdoors_established': 'Build script execution '
'during compilation',
'entry_point': 'Typosquatted Rust package '
'(proc-macro1)',
'high_value_targets': 'Developer workstations, '
'CI/CD pipelines'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Supply chain attacks can exploit build processes to '
'execute malware without direct user interaction. '
'Typosquatting remains a prevalent attack vector. '
'Developers must verify dependencies and monitor build '
'environments for anomalies.',
'motivation': 'Espionage, credential theft, potential financial gain',
'post_incident_analysis': {'corrective_actions': 'Improved package '
'verification, enhanced '
'monitoring of build '
'environments, developer '
'education on supply chain '
'risks',
'root_causes': 'Typosquatting attack on crates.io, '
'exploitation of Rust’s build '
'process, lack of dependency '
'verification'},
'recommendations': ['Rotate all credentials, tokens, and keys exposed during '
'the incident',
'Rebuild artifacts from clean sources',
'Monitor for suspicious activity in development '
'environments',
'Implement dependency verification and integrity checks',
'Enhance build process security (e.g., sandboxing, least '
'privilege)'],
'references': [{'date_accessed': '2024-08-20', 'source': 'Wiz Research'}],
'response': {'communication_strategy': 'Public disclosure by Wiz, advisories '
'to developers',
'containment_measures': 'Removal of malicious packages from '
'crates.io',
'remediation_measures': 'Rotation of credentials, tokens, and '
'keys; rebuilding artifacts from clean '
'sources',
'third_party_assistance': 'Wiz (security researchers)'},
'stakeholder_advisories': 'Developers and organizations using affected Rust '
'packages should treat workstations/CI runners as '
'compromised and follow remediation steps.',
'threat_actor': 'North Korean threat actors (linked to Sapphire Sleet)',
'title': 'Backdoored Rust Packages Expose Developers to Malware During '
'Compilation',
'type': 'Supply Chain Attack',
'vulnerability_exploited': 'Typosquatting (proc-macro1 vs. proc-macro2), '
'build script execution during compilation'}