# Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Hijacked arrayref, internment and append-only-vec crates added typosquatted proc-macro1 whose build.rs downloaded and ran a backdoor during cargo build.

- Payout: Real-world hack
- Severity: critical
- Program: crates.io Rust crates
- Credited: Wiz Research
- Disclosed: 2026-08-20
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns
- Tags: domain:oss impact:data-leak impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:rust technique:source-review vuln:rce

**Target:** Rust crates on crates.io (Cargo build scripts)
**Root cause:** Maintainer account/machine compromised, allowing malicious versions to be published that add a typosquatted dependency (proc-macro1) whose build.rs executes at compile time with full user privileges.
**Steps:**
1. Publish arrayref@0.3.10, internment@0.8.7, append-only-vec@0.1.9 adding `proc-macro1 = "1.0.107"` to Cargo.toml
2. proc-macro1 build.rs reconstructs C2 URL from Base64 fragments (`https://23.254.165[.]112:9089/`)
3. Disable TLS validation via custom AcceptAll verifier
4. Download platform-specific payload (x86_64 Linux/Windows/macOS, aarch64 macOS) to `/tmp/rust-setup` or `%TEMP%\rust-setup.ps1`
5. Execute payload passing C2 beacon address as argv[1]
6. Victim triggers by running `cargo build` on any project depending on the affected crates
**How found:** Wiz Research analyzed crates retrieved from Google Threat Intelligence; noted proc-macro1 was the first dependency added to arrayref in ten years and is a typosquat of proc-macro2, then reviewed build.rs and infrastructure overlap with known DPRK C2 patterns.
**Exploitation:** Build script runs at compile time on developer workstations and CI runners; stage-2 implant beacons via HTTPS POST to `/49890878` with Base64 JSON host info, enumerates apps and browser profiles, persists via Registry Run key/LaunchAgent/systemd user service, and accepts kill/minicfg/startup/runscript commands; DGA fallback generates 10 .com domains every 5 days.
**Escalation:** Compromise of a ubiquitous crate (arrayref in >35% of environments) yields code execution across developer and CI infrastructure, enabling credential/secret theft and supply-chain pivot; infrastructure overlaps DPRK campaigns (Mastra, UNC1069 axios).
**Insight:** A long-stable crate suddenly gaining its first-ever dependency (especially a near-name of a popular crate) is a strong hijack signal; also treat mass-yanking of stable versions as an attack lure to force upgrades, and audit build-dependencies for networking crates in packages with no reason to make network calls.