arrayref 0.1.8 Published from Maintainer Account 20 August, Pulled After 86 Minutes
A maintainer account compromise on crates.io inserted a malicious dependency into arrayref and two related crates. Infrastructure overlaps link the payloads to prior NPM campaigns but lack independent technical confirmation of North Korean attribution. The 86-minute window between publish and takedown limited exposure.
The attack chain began with typosquatted crates (aovine, arone) and three additional packages from the same owner, all pointing to the malicious proc-macro1. The build script beaconed to infrastructure previously observed in the Axios and Mastra NPM campaigns. Rust Security Response Team revoked the packages within 86 minutes; no execution evidence has been reported.
Technical indicators consist of shared Hostwinds IP ranges and one C2 endpoint reused across the three incidents. No code reuse, signing keys, or developer account artifacts have been published that would independently confirm actor continuity. Wiz attributes the activity to Sapphire Sleet on infrastructure overlap alone.
Open-source supply chains remain attractive because crates.io still lacks mandatory 2FA for publishing and reproducible builds are not enforced. The 245 million downloads of arrayref illustrate how a single credential compromise can reach the majority of Rust environments before detection.
Rust team has contacted the maintainer; credential reset and audit of other crates from the same account are the immediate next steps. Expect crates.io to announce mandatory 2FA rollout within 90 days if similar incidents recur.
Rust Security Response Team: No further malicious publishes from the same maintainer accounts within 30 days
Sources (2)
- [1]Primary Source(https://www.securityweek.com/rust-supply-chain-attack-linked-to-north-korean-hackers/)
- [2]Supporting Source(https://blog.rust-lang.org/inside-rust/2024/08/20/security-advisory.html)