Malicious versions of three Rust packages, including the widely used arrayref, were published to the crates.io registry on August 20, carrying a backdoor that executed automatically when affected projects were compiled.
Security researchers at Wiz said the attack also shares infrastructure with recent supply-chain campaigns attributed to North Korean threat actors.
The compromised releases were “[email protected]”, “[email protected],” and “[email protected].” All three introduced a dependency on “proc-macro1,” a typosquat of the legitimate and widely downloaded “proc-macro2” crate.
The malicious dependency contained a build script that downloaded and executed a second-stage payload during ...