Malicious Dependency Compromises Three Popular Rust Crates, Deploys Infostealer

Summary

Aikido reports that malicious dependency proc-macro1 compromised append-only-vec, arrayref and internment, using build-time payloads to target browser credentials and wallet data and establish macOS persistence; the C2 uses 23.254.165.112.

Key points

Aikido detected malicious dependency proc-macro1 in append-only-vec, arrayref and internment; the crates' manifests were changed to include it.
Cargo runs proc-macro1's build script automatically, which downloads and executes a payload for the target operating system and CPU architecture.
The payload targets saved credentials in Chromium-based browsers and browser extension storage, which can contain cryptocurrency wallet data.
Aikido analyzed Linux x86_64 and macOS aarch64 samples; it reports that the Windows PowerShell sample it received was empty.
The macOS payload contains a LaunchAgent template indicating user-level persistence, and supports remote commands including shell execution.
The payload receives its C2 address as a command-line argument; Aikido reports 23.254.165.112:9089 for delivery and 23.254.165.112:443 for C2.
Aikido says the campaign resembles the Axios and Mastra npm compromises, but presents the connection to DPRK / Sapphire Sleet as a similarity, not confirmed attribution.

Article Details

Attack Vectors: Compromised Rust crates added the malicious dependency proc-macro1, whose build script downloaded and executed a platform-specific payload automatically when a project was built.
The proc-macro1 build script downloaded the payload over HTTPS from 23[.]254[.]165[.]112:9089 and, on Unix and macOS, wrote it to /tmp/rust-setup, made it executable, and launched it detached.
On Windows, the build script launched a PowerShell script hidden through a wscript and .vbs launcher; the article says the Windows sample received for analysis was empty.
The payload targeted Chromium-based browser credentials and browser-extension storage, which can contain cryptocurrency wallet data.
The macOS payload included a LaunchAgent template configured to run a shell command at login.
The payload checked in to a C2 server, reported infected-machine details, and supported remote execution commands including runscript, Shell, and ShellX.
Defensive Notes: Aikido recommends checking the central feed for malware issues and triggering a manual rescan.
Review build dependencies for the compromised crates and the malicious proc-macro1 and proc-macro-en packages.

Indicators of compromise

Type	Indicator	Context
IPV4	`23[.]254[.]165[.]112`	Article identifies this IP as the payload-delivery host on port 9089 and the C2 host on port 443.
SHA256	`408ef22050ffc5a67e005802809026b29f297a8019f8fda91a2afa8e877ba434`	SHA-256 of the Linux x86_64 payload binary rust-crate_0.1.0.
SHA256	`74d3447e7cf99c99ea01a16332ec27432dfb0f491e10e67cd118065a60483306`	SHA-256 of the macOS aarch64 payload binary rust-crate_0.4.0.