Overview
- The Rust package registry was compromised Thursday when attacker-controlled releases including arrayref@0.3.10, internment@0.8.7 and append-only-vec@0.1.9 were published with a dependency on a typosquatted crate named proc-macro1.
- The injected crate contained a malicious build.rs that ran during cargo build, reconstructed a C2 URL, disabled TLS checks, downloaded a platform-specific payload and launched a second-stage backdoor that steals browser credentials, beacons to C2 and installs persistence.
- The Rust Security Response Team removed the malicious versions, unyanked earlier safe releases, locked the affected account and credited Nextron with the initial report, noting the maintainer’s machine or credentials were likely compromised.
- Developers are advised to search lockfiles and local cargo caches for the attacker-controlled package names, treat any workstation or CI that built the bad releases as compromised, rotate exposed credentials and rebuild artifacts from known-clean sources.
- Multiple vendor analyses published IOCs and found strong infrastructure overlap with earlier campaigns linked to DPRK actors but stopped short of formal attribution, and the incident has pushed proposals for registry cooldowns and stricter review of build-time network activity.