Hackers Compromise Popular Rust Crate arrayref in Supply-Chain Malware Attack
Hackers compromise the maintainer account behind the popular Rust crate arrayref to inject malware that runs on developers' systems during compilation. In a 23-minute window, the attacker also poisons two other crates maintained by the same account, append-only-vec and internment. The malicious releases include arrayref 0.3.10, append-only-vec 0.1.9, and internment 0.8.7, according to a report from application security company StepSecurity.
The attacker introduces a dependency on a typosquat package called proc-macro1, impersonating the legitimate proc-macro2 crate, while leaving the rest of the source code unchanged. A build script in the fake package executes automatically during compilation, reconstructing its infrastructure from base64-encoded fragments and deploying a payload matching the host operating system. On Unix systems, the malware writes and launches a detached process from /tmp/rust-setup, while on Windows it uses a hidden wscript.exe and VBS launcher to run %TEMP%\rust-setup.ps1.
Analysis from cloud security company Wiz shows the second stage exfiltrates host information and steals credentials from Google Chrome, Brave, and Edge browsers by querying SQLite login databases. The malware establishes persistence through the Registry Run key on Windows, LaunchAgent on macOS, and systemd on Linux. The impact is potentially significant, as arrayref has more than 245 million lifetime downloads and is used by projects including blake3 and Rust GUI frameworks such as egui, eframe, and iced.