arrayref, a Rust crate with 245M downloads, ran malware at build time
A hijacked maintainer account is the way in; the implant steals saved browser passwords, adds persistence, and its fingerprints match a North Korean crew.
Copy markdown
A crate riding in 245M downloads went malicious
An attacker took over the maintainer account behind arrayref and republished it (0.3.10) alongside internment (0.8.7) and append-only-vec (0.1.9), each carrying a hidden backdoor. arrayref has ~245M all-time downloads and rides in as a transitive dependency of common GUI stacks; Wiz estimates the bad versions reached roughly 35% of all machines with Rust installed.
It fires during `cargo build`, not at runtime
The payload lived in a build script that reconstructed a C2 address from base64 fragments, pulled a platform-specific binary from 23.254.165.112, and ran it detached from Cargo. Merely building a poisoned dependency tree — no `cargo run` required — was enough to execute attacker code on your laptop or CI runner.
It goes straight for your browser logins
Once running, the implant enumerates Chrome, Brave, and Edge profiles for saved credentials, collects system info, and installs persistence via Windows Run keys, macOS LaunchAgents, and Linux systemd services. It also opens a channel for arbitrary remote commands.
The fingerprints reportedly point at North Korea
Wiz reports the C2 infrastructure and SSL issuers overlap heavily with DPRK "Sapphire Sleet" / Mastra activity and a prior npm attack — significant overlap, short of hard attribution. Researchers at Nextron flagged the crates within roughly 90 minutes of upload.
What to do right now
crates.io deleted the malicious versions and locked the account, so fresh installs are clean. But check `~/.cargo/registry/cache` for arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9, or any proc-macro1 — if a build pulled them, treat the machine as compromised: rotate browser-stored secrets and rebuild.