Malicious Rust Crates Deliver Backdoor Through Build Scripts
Summary
Three hijacked Rust crates introduced a typosquatted dependency whose build script downloads and runs a platform-specific backdoor. The crates were removed, and researchers report infrastructure overlap with campaigns attributed to North Korean actors.
Key points
- Malicious versions of arrayref, internment, and append-only-vec added the typosquatted proc-macro1 dependency.
- Building an affected project triggered its build script, which downloaded and executed a platform-specific payload.
- The backdoor collects host details, persists across Windows, macOS, and Linux, and supports remote commands and script execution.
- It reads browser profiles and enumerates saved logins; the article clarifies that it does not retrieve the encrypted credential material.
- Researchers found command-and-control infrastructure overlaps with campaigns attributed to DPRK-linked actors; the overlap does not by itself confirm attribution.
- The Rust Security Response Team deleted the malicious releases and locked the account; it assesses that the maintainer's machine or credentials were compromised.
- The article advises checking Cargo lockfiles and caches, treating hosts that built affected versions as compromised, rotating accessible secrets, and rebuilding from clean sources.
Article Details
- Attack Vectors
- Malicious Rust crates added the typosquatted proc-macro1 dependency, whose build script downloaded and executed a platform-specific payload when an affected project was compiled.
- The second-stage backdoor beaconed to C2 over HTTPS POST, sent host information, and supported downloading and executing PowerShell or shell scripts.
- The backdoor established persistence through a Windows Registry Run key, a macOS LaunchAgent, or a Linux systemd user service.
- Defensive Notes
- Search Cargo.lock files and local Cargo caches for the identified malicious crate names and versions.
- Treat developer workstations and CI runners that built affected projects as compromised; rotate reachable credentials, tokens, keys, CI secrets, and signing keys, and rebuild artifacts from clean sources.
- Remove the identified payload and launcher files, check for unrecognized systemd user services, HKCU Run entries, and LaunchAgents, and redeploy affected workloads from a clean state.
- Review new or changed build dependencies, especially networking crates in packages without a reason to make network requests; investigate unexpected yanks of multiple stable versions.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | hwsrv-798836[.]hostwindsdns[.]com | Attacker infrastructure hostname used by the operation. |
rchaitm@gmail[.]com | Forged author email metadata in the malicious proc-macro1 package. | |
| IPV4 | 23[.]254[.]165[.]112 | Attacker-controlled host serving the stage-two payload and used as the C2 address. |
| IPV4 | 23[.]254[.]167[.]107 | Stage-two C2 address reported live at publication. |
| SHA1 | f22e3e01e38bcdf001f0d15a2dbfdec5a1cf8eff | Hash of the malicious proc-macro1-1.0.107 crate. |
| SHA1 | f4767ad92cb61401fd69139cade563501c39b991 | Hash of the Linux stage-two payload. |
| SHA1 | fc0fdb978eac72f4484b48db058e4473f1bc516e | Hash of the Windows stage-two payload. |
| SHA1 | ff7e20cf642346bf893f1eca808df82035bb53d0 | Hash of the macOS arm64 stage-two payload. |
| SHA256 | 25ad700976873c76af785cb99b33c48db7df8b81f21d1e9e06b3676b9a9373ae | Hash of the hijacked arrayref-0.3.10 crate. |
| SHA256 | 61198155da51b838772eecf5bfaac6cbc4dcc388dccc56658fc28a8e831b34d4 | Hash of the malicious proc-macro1-1.0.107 crate. |
| SHA256 | b5c1b5b0763a8809a644a8f92224653f0aca623a98eecc714d27f74b80fbe436 | Hash of the malicious proc-macro1-1.0.106 crate. |
MITRE ATT&CK
T1059.001 · PowerShellThe backdoor supports downloading and executing PowerShell scripts on Windows.T1059.004 · Unix ShellThe backdoor supports downloading and executing shell scripts.T1071.001 · Web ProtocolsThe implant communicates with C2 via HTTPS POST.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious dependencies were published as Rust crates and introduced into downstream projects through the software supply chain.T1543.001 · Launch AgentThe backdoor persists on macOS through a LaunchAgent.T1543.002 · Systemd ServiceThe backdoor persists on Linux through a systemd user service.T1547.001 · Registry Run Keys / Startup FolderThe backdoor persists on Windows through a Registry Run key.T1555.003 · Credentials from Web BrowsersThe implant queries Chrome, Brave, and Edge profile SQLite credential stores and enumerates saved logins; the article clarifies it does not retrieve encrypted credential material.T1567 · Exfiltration Over Web ServiceThe implant exfiltrates host information and enumerated data to its C2.T1583.001 · DomainsThe operation used attacker infrastructure hosted on VPS IP addresses.
Threat Actors
Sapphire SleetMicrosoft attributed the Mastra campaign, which shared a C2 endpoint pattern with this incident, to DPRK / Sapphire Sleet; the article does not attribute the Rust crate attack to Sapphire Sleet.UNC1069Google Cloud Threat Intelligence associated 23.254.167[.]216 with UNC1069's axios npm attack; Mandiant links that activity to North Korea. The article does not attribute the Rust crate attack to UNC1069.
Vendors
Products
append-only-vecversions of three Rust crates were published to crates.io: arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9. The malicious crates added a typosquatted dependency (proc-macro1) whose build scriptarrayrefOn August 20, 2026, malicious versions of three Rust crates were published to crates.io: arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9. The malicious crates added a typosquatted dependency (proc-macro1)Bravehostname, username and operating system details, enumerates installed applications, and reads Chrome, Brave and Edge profiles for saved logins and extension settings, querying the browsers' SQLite credential storesEdgeusername and operating system details, enumerates installed applications, and reads Chrome, Brave and Edge profiles for saved logins and extension settings, querying the browsers' SQLite credential stores directly.Google ChromeCollects hostname, username and operating system details, enumerates installed applications, and reads Chrome, Brave and Edge profiles for saved logins and extension settings, querying the browsers' SQLite credentialinternmentAugust 20, 2026, malicious versions of three Rust crates were published to crates.io: arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9. The malicious crates added a typosquatted dependency (proc-macro1)proc-macro1internment@0.8.7, and append-only-vec@0.1.9. The malicious crates added a typosquatted dependency (proc-macro1) whose build script downloads and executes a remote binary. Notably, proc-macro1 was the firstproc-macro2proc-macro1 is a typosquat of the legitimate proc-macro2 crate (154M+ downloads).