Critical: Rust `arrayref` Crate Poisoned with Infostealer Malware

Critical Supply Chain Attack Poisons Widely Used Rust Crates

Threat actors have executed a sophisticated supply chain attack, compromising maintainer accounts for several popular Rust crates—arrayref, append-only-vec, and internment—to distribute infostealer malware. The incident, which had a narrow exposure window of approximately 1.5 hours, allowed malicious code to execute on developers’ systems during compilation, posing a significant risk to development environments and downstream projects. The arrayref crate alone boasts over 53 million downloads in the past 90 days and a lifetime count exceeding 245 million, indicating the widespread potential impact of this compromise, according to BleepingComputer.

Technical Analysis of the Infostealer Campaign

Beginning at 01:17 UTC on August 20, the attackers created GitHub and crates.io accounts impersonating prominent Rust developers. The attack leveraged a typosquatting technique, introducing a dependency on a malicious package named proc-macro1, which mimicked the legitimate proc-macro2 crate. While the initial proc-macro1@1.0.106 release was benign, a subsequent update to version 1.0.107 at 07:11 UTC introduced the malicious payload.

At 07:15 UTC, arrayref version 0.3.10 was published via a legitimate maintainer account, alongside the removal of versions 0.3.5 through 0.3.9, likely to force installations of the compromised release. The proc-macro1 package included a build.rs script that automatically executes during compilation. This script was engineered to reconstruct its infrastructure from base64-encoded fragments and deliver a tailored infostealer payload matching the host operating system (Linux x86-64, Windows x86-64, macOS x86-64, and macOS ARM64).

Analysis by cloud security company Wiz indicates that the second-stage capabilities of this malware include exfiltrating host information and credentials. Specifically, the infostealer targeted credentials stored in SQLite login databases for popular browsers such as Google Chrome, Brave, and Edge. To ensure persistence across various operating systems, the malware establishes footholds via the Registry Run key on Windows, LaunchAgent on macOS, and systemd on Linux. The campaign’s infrastructure also shows overlaps with recent supply chain attacks attributed to DPRK (North Korean) threat groups, including the Mastra and axios campaigns.

Affected Components and Attack Timeline

The malicious Rust crate releases identified by StepSecurity were arrayref 0.3.10, append-only-vec 0.1.9, and internment 0.8.7. These crates are widely used in critical projects, including cryptography tools like blake3, Rust GUI frameworks (egui, eframe, iced), and components within the Ethereum and Solana blockchain ecosystems. The collective download count for append-only-vec and internment alone nears 19 million installs.

The swift response from crates.io led to the deletion of proc-macro1 at 08:03 UTC and the removal of arrayref 0.3.10 from the index at 08:41 UTC, limiting the overall exposure duration. However, any development environment that installed these specific malicious versions during the roughly 1.5-hour window, between 07:15 UTC and 08:41 UTC on August 20, 2024, should be considered compromised.

Actionable Recommendations: Mitigate Rust Crate Infostealer Risks

Organizations and developers must prioritize immediate actions to address potential exposure and secure their development pipelines. The following steps are crucial for effective remediation and preventing future incidents:

• Assume Compromise: If your projects installed arrayref 0.3.10, append-only-vec 0.1.9, or internment 0.8.7 during the exposure window, assume your development environment is compromised.
• Identify Affected Systems: Review Cargo.lock files within your projects to identify any dependencies on the malicious crate versions.
• Detect Arrayref Supply Chain Attack Artifacts: Look for dropped files such as /tmp/rust-setup on Unix-like systems and %TEMP%\rust-setup.ps1 on Windows. Review network traffic for connections to 23.254.165[.]112 on ports 9089 and 443, which are believed to be command-and-control addresses.
• Credential Rotation: Immediately rotate all accessible credentials, CI tokens, signing keys, and any other secrets that may have been present on a compromised machine.
• Environment Rebuild: Rebuild development and build environments from known-safe backups or clean images to ensure no lingering malware or persistence mechanisms remain.
• Pin Safe Versions: For projects not yet compromised, pin dependencies to known-safe versions of the affected crates. This helps prevent accidental installation of a potentially reintroduced malicious version until the maintainer situation is fully clarified and resolved.

These measures are essential to addressing a compromised Rust development environment remediation strategy and bolstering the security posture against similar supply chain threats.

Related: Rust Supply Chain Attack Puts Build-Time Malware in Crates, AUR Compromise: 400+ Packages Distributing Rootkits and Infostealers