Wiz Links Malicious Rust Crate Releases to North Korean Hackers
Summary
Wiz links malicious Rust crate releases on August 20 to North Korean actor Sapphire Sleet, citing infrastructure overlaps. The packages were removed within about 86 minutes, and Rust’s security team found no evidence they were used.
Key points
- A malicious release of the popular Rust crate arrayref was published on August 20 from its legitimate maintainer’s account.
- Poisoned releases of internment and append-only-vec followed; the packages and attacker-owned crates referenced a dependency impersonating proc-macro2.
- A malicious build script was designed to fetch a platform-specific second-stage binary over TLS while disabling certificate validation.
- The Rust Security Response Team removed the malicious packages about 86 minutes after release and restored clean versions.
- The Rust security team found no evidence the malicious crates were used and said the maintainer’s computer or credentials were likely compromised.
- Wiz assessed that North Korean actor Sapphire Sleet was likely responsible, citing infrastructure overlaps with the Axios and Mastra campaigns.
Article Details
- Event Type
- Open-source software supply-chain attack targeting the Rust ecosystem
- Impact
- A malicious release of the arrayref crate and related poisoned crates introduced a dependency that executed a malicious build script designed to download a platform-specific second-stage binary. The Rust Security Response Team removed the packages and restored clean versions. It reported no evidence that the malicious crates had been used; the maintainer’s computer or credentials were believed likely compromised.