Wiz says a supply chain attack that infected arrayref, a Rust package present in roughly three-quarters of Rust-running environments, drew comparisons to recent North Korean operations.
The malicious update hid a backdoor that steals credentials within code designed to run automatically during user project compilation. Thus, anyone who compiled a project on Thursday could now have compromised their computer and their secrets.
Why is North Korea being blamed for hacking ArrayRef?
Wiz researchers Rami McCarthy and Benjamin published a report noting that the arrayref payload routes signals to the control channel /49890878, which also appears in the Mastra campaign.
Microsoft links the Mastra campaign to a North Korean hacking group it calls Sapphire Sleet.
The internet address (IP) used in the arrayref attack has the same security certificate as another address used in Mastra. Additionally, a victim reporting suspicious activity noted an IP address that Google Cloud discovered in an axios npm attack.
Mandiant states the attack was carried out by a North Korean group called UNC1069. Both attacks used the same hosting company, Hostwinds.
The attack was hard to spot because it changed almost nothing. Ilya Makari, a security researcher from Aikido, discovered that the code itself within three Rust packages—arrayref, internment, and append-only-vec—was not altered. The only change was the addition of one new dependency to each package's list called proc-macro1.
This name is a misspelling of the popular crate proc-macro2, which has been downloaded over 154 million times. The fake crate even includes real proc-macro2 code, so the software still compiles and passes all tests.
The malicious part was hidden in the build script.
The Rust Security Response Team explained that simply compiling a project using the flawed version was enough to trigger the attack.
After execution, the second stage of the attack stole saved passwords from Chrome, Brave, and Edge browsers and installed itself to persist after computer restart on Windows, Mac, and Linux.
The Largest Rust Compromise by Number of Downloads
Aikido stated this attack is the largest Rust crate hack it has encountered, judged by download numbers: arrayref, used in tools for Solana and Ethereum, was downloaded approximately 244 million times. The vulnerability reportedly persisted for 86 minutes before being removed.
The team reported that the initial report came fromtron Systems. After detecting the attack, the team deleted the clean versions and blocked the developer account.
The Rust development team stated it does not believe the author's actions were malicious, suspecting their computer ordent data was compromised.
Notably, Amazon reported a link between several npm library hacks and a single entity linked to North Korea. TRM Labs also reported that North Korean groups accounted for about 76% of all cryptocurrency hack amounts between April 2026 (approximately $577 million).
Black Hat researcher Vangelis Stykas said he tracks North Korean hackers who have breached 1,640 companies in 57 countries. He found they often lure developers with fake job offers that install malware, similar to the poisoned build dependency in this case.
end-content
