North Korean State-Sponsored Supply Chain Attack on Rust's crates.io

North Korean state-sponsored actor Sapphire Sleet executed a supply chain attack on the Rust ecosystem by compromising a maintainer account on crates.io. The attackers published malicious versions of arrayref (v0.3.10), internment (v0.8.7), and append-only-vec (v0.1.9), which introduced a typosquatted dependency, proc-macro1. The payload executed during the compilation process via build.rs scripts, enabling host enumeration, browser profile exfiltration, and persistence across Windows, macOS, and Linux. The campaign utilized a Domain Generation Algorithm (DGA) for C2 resiliency and disabled TLS validation to bypass security controls, specifically targeting developer workstations and CI/CD pipelines.

• Incident Overview: Account Compromise & Delivery

  • Attacker compromised a crates.io maintainer account to push malicious updates to three widely used crates.
  • Deployed proc-macro1 as a typosquatted replacement for the legitimate proc-macro2 library.
  • Targeted high-traffic packages; arrayref alone recorded 53.7 million downloads in the 90 days prior to the attack.

• Attack Vector: Build-Time Execution Mechanics

  • Execution occurred during cargo build via the build.rs script, bypassing the need for the developer to execute the compiled binary.
  • This vector directly compromises developer workstations and automated CI/CD runners during the dependency resolution phase.
  • Exposure windows were brief, ranging from 86 to 107 minutes before remediation by The Rust Project.

• Payload Capabilities: Exfiltration & Persistence

  • Conducted comprehensive host enumeration, including OS details, usernames, and installed application lists.
  • Targeted browser profiles (Chrome, Brave, Edge) to steal saved login credentials and extension data.
  • Established cross-platform persistence using Windows Registry Run keys, macOS LaunchAgents, and Linux systemd user services.

• C2 Infrastructure & Attribution

  • Attributed to Sapphire Sleet (DPRK) due to infrastructure overlaps with the Mastra and Axios campaigns.
  • C2 URLs were reconstructed from Base64 fragments and employed a DGA generating 10 domains every five days.
  • Security bypasses included the explicit disabling of TLS certificate validation for outbound C2 traffic.

• Detection & Defensive Actions

  • Inspect Cargo.lock files for the presence of proc-macro1 or the compromised versions of arrayref, internment, and append-only-vec.
  • Monitor for anomalous outbound network traffic originating from build processes or compiler toolchains.
  • Implement strict CI/CD pipeline auditing and utilize pinned dependencies to prevent automatic updates to malicious versions.