Hackers compromised the maintainer account for the Rust crate arrayref and pushed a malicious update that executed during compilation, while also poisoning append-only-vec and internment in the same supply-chain attack. The campaign affected widely used Rust projects and showed infrastructure overlaps with recent DPRK-linked attacks, prompting developers to check for compromise and rotate exposed secrets. #arrayref #append-only-vec #internment #proc-macro1 #StepSecurity #Wiz #Cratesio #Rust
Keypoints
- Attackers hijacked the maintainer account for arrayref and released malware through a malicious crate update.
- The same 23-minute window was used to poison append-only-vec and internment.
- The fake dependency proc-macro1 used build.rs to run during compilation and deploy OS-specific payloads.
- The malware could steal browser credentials, host information, and maintain persistence on Windows, macOS, and Linux.
- Developers are advised to check Cargo.lock files, review suspicious network traffic, and rotate secrets if affected.