Malicious Rust library arrayref compromised in supply chain attack

Odaily Planet Daily reports: On August 20, attackers released malicious versions of three widely used Rust code packages via a supply chain attack, with arrayref being used in approximately three-quarters of Rust development environments. The malicious update concealed a backdoor that automatically steals login credentials when users compile their projects; users who compiled the affected versions may have had their computers and keys compromised. Wiz researchers noted that the command-and-control infrastructure used in the arrayref attack overlaps with that of the North Korean hacking groups Sapphire Sleet and UNC1069’s Mastra operation, sharing the same IP addresses, security certificates, and hosting provider, Hostwinds. The attackers only added a misspelled dependency, proc-macro1, to mimic the popular proc-macro2, without modifying the original code, allowing the malicious versions to pass tests and builds. The malicious versions were removed 86 minutes after publication but had already been downloaded extensively; the affected packages are widely used in Solana and Ethereum tools. The Rust team believes the maintainers acted without malice and that their devices or credentials were likely compromised.