Backdoored Rust packages hit crates.io, exposing developers to malware at build time
Brief
Malicious versions of three Rust packages, including the widely used arrayref, were published to the crates.io registry on August 20, carrying a backdoor that executed automatically when affected projects were compiled.
Security researchers at Wiz said the attack also shares infrastructure with recent supply-chain campaigns attributed to North Korean threat actors.
The compromised releases were “arrayref@0.
- 10”, “internment@0.
- 7,” and “append-only-vec@0.
- 9.” All three introduced a dependency on “proc-macro1,” a typosquat of the legitimate and widely downloaded “proc-macro2” crate.
The malicious dependency contained a build script that downloaded and executed a second-stage payload during compilation, Wiz researchers said in a blog post .