Supply Chain Attack Targeting Rust Ecosystem via Malicious Crate Dependencies

On August 20, 2026, researchers identified a sophisticated supply chain attack targeting the Rust ecosystem. Attackers compromised maintainer credentials to publish malicious versions of three widely used crates: arrayref (0.3.10), internment (0.8.7), and append-only-vec (0.1.9). These crates were modified to include a dependency on 'proc-macro1', a typosquatted version of the legitimate 'proc-macro2' crate.

The attack leverages the fact that Cargo build scripts are executed with user privileges at compile time. By embedding malicious logic within the build.rs file of the typosquatted crate, the attackers achieve remote code execution whenever an affected project is built. The second-stage payload is a feature-rich backdoor capable of host reconnaissance, browser credential theft, and persistent access. Infrastructure analysis reveals significant overlap with prior supply chain campaigns attributed to North Korean state-sponsored actors, specifically the Mastra and axios campaigns, utilizing Hostwinds LLC infrastructure. Given the ubiquity of these crates, any workstation or CI/CD runner that has built an affected version should be treated as compromised.

Attack Chain

1. Attacker compromises crates.io maintainer credentials or workstation to gain publication access.
2. Attacker publishes malicious versions of arrayref, internment, and append-only-vec, injecting a dependency on the typosquatted 'proc-macro1' crate.
3. Victim project builds a dependency tree including the malicious 'proc-macro1' crate.
4. Cargo triggers the malicious 'build.rs' script within 'proc-macro1' during the compilation phase.
5. Build script reconstructs the C2 URL from Base64 fragments and downloads a platform-specific binary payload (e.g., Linux, Windows, or macOS).
6. The payload is written to a temporary directory (/tmp/rust-setup or %TEMP%\rust-setup.ps1) and executed in the background.
7. The backdoor establishes persistence via systemd services, Registry Run keys, or LaunchAgents.
8. The backdoor exfiltrates host metadata and stolen browser credentials to the C2 server using HTTPS POST requests.

Impact

The campaign affects any developer workstation or automated CI/CD environment that compiled the compromised crates. Successful execution results in full system access, persistent backdoor deployment, and the exfiltration of credentials stored in Chrome, Brave, and Edge browsers. As arrayref is present in a significant percentage of Rust environments, the potential exposure for enterprise build pipelines is substantial, necessitating a full credential rotation and forensic review of affected infrastructure.

Recommendation

1. Perform an immediate search for the compromised crate versions (arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9) in all 'Cargo.lock' files and local registry caches.
2. Treat all hosts that have compiled these crates as compromised; rotate all credentials, signing keys, and CI secrets accessible from those machines.
3. Delete malicious artifacts including '/tmp/rust-setup', '%TEMP%\rust-setup.ps1', and '%TEMP%\rust-setup-launch.vbs'.
4. Block the C2 IP addresses (23.254.165.112 and 23.254.167.107) and the domain 'hwsrv-798836.hostwindsdns.com' at the network perimeter.
5. Review all new or modified 'build-dependencies' entries in 'Cargo.toml' files, specifically flagging crates that perform unexpected network activity.