Hackers compromise Rust crate arrayref to inject malware

Hackers compromised the maintainer account for the widely used Rust crate arrayref to introduce malware that executed on developers’ systems during compilation, Wiz reports. Within a 23-minute window, the attacker also poisoned two other crates, append-only-vec and internment, in the same supply-chain attack, based on information published by Bleeping Computer.

The attack involved injecting a dependency on a malicious package, proc-macro1, which impersonated the popular proc-macro2 crate. A script within proc-macro1, named "build.rs," executed during compilation, reconstructing its infrastructure and selecting a payload matching the host OS. The malware then wrote to /tmp/rust-setup on Unix systems and created %TEMP%\rust-setup.ps1 on Windows, launching itself as a detached process. The payload was designed to exfiltrate host information and credentials from browsers like Google Chrome, Brave, and Edge. Persistence was established through various OS-specific methods.

The arrayref crate alone has over 245 million lifetime downloads, with significant usage in cryptography, graphics, and blockchain tools, including components for Ethereum and Solana. The campaign's infrastructure shows overlap with recent North Korean supply chain attacks, according to Wiz researchers.

Source: Bleeping Computer