TL;DR:
- Affected packages: Malicious versions of the Rust crates arrayref (@0.3.10), append-only-vec (@0.1.9), and internment (@0.8.7) were published on crates.io on August 20, 2026.
- Library scope: The arrayref crate accounts for over 244 million cumulative downloads and is present across three-quarters of environments where Rust operates.
- Security response: The Rust Security Response Team removed the compromised packages after they remained active for 86 to 107 minutes on the official registry.
Cybersecurity researchers identified the suspected involvement of North Korean hackers in a Rust supply chain attack targeting Arrayref and other critical dependencies on Thursday, August 20.
The attack vector originated after the credentials or the machine of the project’s legitimate maintainer were compromised. Leveraging this unauthorized access, the attackers uploaded tampered versions that introduced a dependency on a malicious package named proc-macro1.
The build script (build.rs) executed malicious code during the software packaging process. According to a technical analysis published by the security firm Aikido, the compiled payload integrated functions designed to extract browser credentials and access the local storage of crypto wallet extensions.
Infrastructure links to state-sponsored cyber espionage campaigns
The Wiz Threat Intelligence team reported significant technical overlaps between the servers used in this attack and previous campaigns attributed to the Pyongyang regime. The command and control (C2) infrastructure utilized IP address ranges associated with hosting provider Hostwinds LLC.
Data from Wiz indicates that these same addresses had previously appeared in reports from Google Cloud Threat Intelligence and Mandiant linked to the advanced persistent threat group UNC1069, an actor associated with offensive campaigns against open-source ecosystems like npm. The report suggests that state-sponsored actors may be expanding their tactical vectors toward low-level dependencies in Rust to compromise targets within the digital asset industry and corporate development environments.
The operational response from repository administrators mitigated initial exposure. The Rust Security Response Team revoked the contaminated packages and temporarily locked the developer’s account as a precautionary measure. The compromised version of arrayref remained available for 86 minutes before being removed from the official crates.io indices.
Cybersecurity teams and repository administrators are actively reviewing Cargo.lock files to verify the absence of dependencies on proc-macro1, proc-macro-en, or unauthenticated versions in local builds. The Rust Security Team will continue publishing technical updates as the forensic audit into the compromised credentials progresses.
