Malicious Rust Crate Updates Target Developers With Infostealer Malware
Summary
Attackers hijacked the arrayref maintainer account and poisoned two other Rust crates. A malicious dependency ran during compilation to deploy credential-stealing malware; developers are advised to check for compromise and rotate exposed secrets.
Key points
- Attackers used a compromised maintainer account to publish malicious updates to arrayref, append-only-vec, and internment within 23 minutes.
- The updates added proc-macro1, a typosquat of proc-macro2, whose build.rs script ran during compilation and selected an OS-specific payload.
- Researchers reported credential and host-information theft, including browser credentials, with persistence mechanisms for Windows, macOS, and Linux.
- Crates.io removed proc-macro1 and the malicious arrayref release; the article says the exposure window lasted nearly 1.5 hours.
- Developers are advised to inspect Cargo.lock files and suspicious network traffic, rotate accessible credentials and secrets if affected, and pin known-safe dependency versions.
Article Details
- Event Type
- Rust software supply-chain compromise involving malicious crate releases.
- Impact
- Malicious crate updates introduced a dependency that executed during compilation and deployed OS-specific malware. The malware could collect host information and browser credentials and establish persistence on Windows, macOS, and Linux. Developers who installed affected releases during the exposure window were advised to assume compromise and rotate exposed secrets.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 23[.]254[.]165[.]112 | The article advises reviewing traffic to this address; the malware reportedly receives an address believed to be for command and control. |
MITRE ATT&CK
T1195.001 · Compromise Software Dependencies and Development ToolsAttackers compromised a crate maintainer account and distributed malicious updates through affected Rust packages.T1543.001 · Launch AgentThe malware reportedly established persistence using a LaunchAgent on macOS.T1543.002 · Systemd ServiceThe malware reportedly established persistence using systemd on Linux.T1547.001 · Registry Run Keys / Startup FolderThe malware reportedly established persistence through the Windows Registry Run key.T1555.003 · Credentials from Web BrowsersThe malware reportedly queried SQLite login databases to collect credentials from Google Chrome, Brave, and Edge.
People
Products
append-only-vecHackers compromised the maintainer account for the Rust crate arrayref and pushed a malicious update that executed during compilation, while also poisoning append-only-vec and internment in the same supply-chain attack.arrayrefHackers compromised the maintainer account for the Rust crate arrayref and pushed a malicious update that executed during compilation, while also poisoning append-only-vec and internment in the same supply-chain attack.internmentHackers compromised the maintainer account for the Rust crate arrayref and pushed a malicious update that executed during compilation, while also poisoning append-only-vec and internment in the same supply-chain attack.proc-macro1#arrayrefproc-macro2The hacker injected a dependency on a package called proc-macro1, a typosquat impersonating the popular proc-macro2 crate, while retaining the rest of the upstream source code completely unchanged.