A backdoor that fires at cargo build: the arrayref poisoning puts your build boxes in scope
Malicious versions of three Rust crates ran code at compile time on August 20. Wiz says the infrastructure overlaps with DPRK operations, so the campaign should be treated as live.
The Watch · Security desk
What happened
- On August 20, 2026, malicious versions of three Rust crates were published to crates.io: arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9.
- The malicious crate versions added a typosquatted dependency, proc-macro1, whose build script downloads and executes a remote binary.
- Because Cargo executes build scripts at compile time, building a project that depends on proc-macro1 was sufficient to trigger the payload.
- arrayref can be found in over 35% of all environments.
- arrayref is used in three quarters of all environments where Rust is present.
Why it matters
On August 20, 2026, malicious versions of three Rust crates were published to crates.io: arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9, each carrying a new typosquatted dependency called proc-macro1 whose build script downloads and executes a remote binary [1][2]. Because Cargo runs build scripts during compilation, building an affected project was enough to execute the payload, which moves the exposed asset from the artifact you shipped to the machine that compiled it [5].
The blast radius is the uncomfortable part. According to Wiz, arrayref appears in more than 35% of all environments and in three quarters of all environments where Rust is present [6][7]. proc-macro1 is a typosquat of proc-macro2, a crate with more than 154 million downloads, and it was the first dependency ever added to arrayref in the crate's ten-year history [3][22]. That single line in Cargo.toml is the whole trick [4].
The build script reconstructs a command-and-control URL from Base64 fragments, one example being https://23.254.165[.]112:9089/, disables TLS certificate validation with a custom AcceptAll verifier, downloads a payload matched to the host OS and architecture, writes it to /tmp/rust-setup on Unix or %TEMP%\rust-setup.ps1 on Windows, and runs it with the beacon address as an argument [8]. The build then completes and the package works normally, which is why nobody noticed at compile time [9]. Second-stage support covers x86_64 Linux, Windows and macOS plus aarch64 macOS [10].
The implant beacons over HTTPS POST to the path /49890878, exfiltrating host information and stolen credentials as Base64-encoded JSON [11]. It reads saved logins from Chrome, Brave and Edge by querying their SQLite login databases [26]. It persists through a Registry Run key on Windows, a LaunchAgent on macOS, or a systemd user service on Linux [14]. It takes four commands: kill, minicfg, startup and runscript [16]. Its configuration is encrypted with AES-128-GCM under the hardcoded key "i am botking", and commands are authenticated with an embedded RSA-2048 private key [23]. If the primary C2 is unreachable it falls back to a domain generation algorithm producing ten .com domains every five days, which Wiz says are not currently registered [24]. That is roughly 730 candidate domains a year sitting unclaimed [25].
Wiz ties the operation to North Korean activity on two threads: the /49890878 beacon path was used in the Mastra campaign, which Microsoft attributed to DPRK actor Sapphire Sleet, and the arrayref beacon IP shares an SSL issuer string with 23.254.167[.]13, also used in Mastra [19][20]. Wiz's headline places the overlap alongside axios as well [21].
Remediation is not a version bump. Wiz's guidance is to treat any developer workstation or CI runner that built an affected project as compromised, rotate every credential, token and key reachable from it including CI secrets and signing keys, and rebuild any artifacts produced after exposure from clean sources [12]. Reset browser-stored passwords and revoke the associated sessions [13]. Delete /tmp/rust-setup, %TEMP%\rust-setup.ps1 and %TEMP%\rust-setup-launch.vbs, then check for unrecognised systemd user services, HKCU Run entries and LaunchAgents [15].
One operational detail deserves repeating: the attack used yanking to drive upgrades, so Wiz advises treating a sudden yank of several stable versions of a long-lived crate as a reason to investigate rather than to upgrade [17]. Grep Cargo.lock across your repositories for the malicious versions and for all six attacker-controlled crate names [18].
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence80
- Adoption30
- Hype gap+25
- Incentives55
- Confidence75
Perspective Coverage
6 publishers- Builder
- Builder 45%
- Operator
- Operator 48%
- Investor
- Investor 7%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
On August 20, 2026, malicious versions of three Rust crates were published to crates.io: arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9.
- [2]
The malicious crate versions added a typosquatted dependency, proc-macro1, whose build script downloads and executes a remote binary.
- [3]
proc-macro1 is a typosquat of the legitimate proc-macro2 crate, which has more than 154 million downloads.
- [4]
The impacted package versions add the line proc-macro1 = "1.0.107" to the [dependencies] section of Cargo.toml, and proc-macro1's build.rs contains the malicious logic.
- [5]
Because Cargo executes build scripts at compile time, building a project that depends on proc-macro1 was sufficient to trigger the payload.
- [6]
arrayref can be found in over 35% of all environments.
- [7]
arrayref is used in three quarters of all environments where Rust is present.
- [8]
At compile time the build script reconstructs a C2 URL from Base64 fragments (for example https://23.254.165[.]112:9089/), disables TLS certificate validation via a custom AcceptAll verifier, downloads a platform-specific payload based on OS and architecture, writes it to /tmp/rust-setup on Unix or %TEMP%\rust-setup.ps1 on Windows, and executes it passing the C2 beacon address as an argument.
- [9]
The build otherwise completes and the package functions normally.
- [10]
The second stage payload is selected by platform, with support for x86_64 Linux, Windows and macOS, plus aarch64 macOS.
- [11]
The payload beacons to C2 via HTTPS POST to the endpoint /49890878, exfiltrating host info and stolen credentials as Base64-encoded JSON.
- [12]
Wiz advises treating any developer workstation or CI runner that built an affected project as compromised, rotating every credential, token and key reachable from it including CI secrets and signing keys, and rebuilding any artifacts produced after exposure from clean sources.
- [13]
Wiz advises resetting browser-stored passwords and revoking associated sessions, because the payload reads saved logins and extension data from Chrome, Brave and Edge profiles.
- [14]
The payload persists via a Registry Run key on Windows, a LaunchAgent on macOS, or a systemd user service on Linux.
- [15]
Wiz advises deleting /tmp/rust-setup, %TEMP%\rust-setup.ps1 and %TEMP%\rust-setup-launch.vbs where present, and checking for unrecognized systemd user services, HKCU Run entries and LaunchAgents.
- [16]
The payload supports four commands: kill (terminate), minicfg (reconfigure C2 and beacon interval), startup (install persistence), and runscript (download and execute PowerShell or shell scripts).
- [17]
Wiz says the attack used yanking to drive upgrades and advises treating a sudden yank of multiple stable versions of a long-lived crate as a signal to investigate rather than upgrading blindly.
- [18]
Wiz advises searching Cargo.lock across repositories for the malicious versions and for any of the six attacker-controlled crate names, and checking the local cache.
- [19]
The arrayref payloads beacon to /49890878, an endpoint also used in the Mastra campaign, which Microsoft attributed to DPRK actor Sapphire Sleet.
- [20]
The IP address used in the arrayref beacon shares an SSL issuer (WIN-A6QF8AHPQH1\Administrator@WIN-A6QF8AHPQH1) with 23.254.167[.]13, also used in the Mastra campaign.
- [21]
Wiz states the campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios.
- [22]
proc-macro1 was the first dependency added to arrayref in its ten-year history.
- [23]
Configuration is encrypted with AES-128-GCM using the hardcoded key "i am botking", and commands are authenticated via an embedded RSA-2048 private key.
- [24]
If the primary C2 is unreachable the payload falls back to a domain generation algorithm generating 10 algorithmic .com domains every 5 days; currently those domains do not appear to be registered.
- [25]
Ten domains every five days works out to roughly 730 candidate domains per year.
- [26]
The payload steals browser credentials from Chrome, Brave and Edge by querying SQLite login databases.
Sources
6 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comHackers poison arrayref Rust crate to push infostealer malware
1 article · August 20, 2026
- scworld.comHackers compromise Rust crate arrayref to inject malware
1 article · August 20, 2026
- securityweek.comRust Supply Chain Attack Linked to North Korean Hackers
1 article · August 21, 2026
- Step Security
stepsecurity.io
1 article · August 20, 2026
- thehackernews.comRust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
2 articles · August 21, 2026
- wiz.ioRust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns
1 article · August 20, 2026
Topics and entities
Entities
- Nextron Systems GmbH
- StepSecurity
- Microsoft
- Rust
- proc-macro1
- Cargo
- crates.io
- arrayref
- Rust Security Response Team
- proc-macro2
- RUSTSEC-2026-0260
- Wiz