North Korean Sapphire Sleet Hackers Poison Popular Rust Crate in Supply Chain Attack

Cybersecurity firm Wiz has attributed a sophisticated open-source software (OSS) supply chain attack against the Rust ecosystem to the North Korean threat actor tracked as Sapphire Sleet. On August 20, adversaries compromised the maintainer account of “arrayref,” a widely used array-conversion crate with over 245 million downloads present in roughly 75% of Rust development environments, publishing a malicious version (“arrayref 0.9.0”) to crates.io. Within 20 minutes, poisoned iterations of two related crates from the same maintainer—“internment” and “append-only-vec”—were also released, alongside attacker-controlled packages “aovine,” “arone,” “aronenao,” and “tinymember,” all of which referenced a typosquatted dependency impersonating the legitimate “proc-macro2” package.

Inside the malicious dependency, threat actors embedded a weaponized build script (“build.rs”) that disabled TLS certificate validation before fetching a platform-specific second-stage payload. The Rust Security Response Team identified the compromise roughly 86 minutes after publication, confirming that “a new version of the arrayref crate was published with a direct dependency on proc-macro1, which would execute a malicious build script.” All poisoned crates were subsequently removed, clean versions restored, and the team stated it found no evidence that downstream users actually executed the malicious payloads. The team also noted that “we do not believe the author of arrayref to be acting maliciously, but their computer or credentials are likely compromised,” a scenario that should prompt developers to run an email breach checker against any maintainer account used to publish crates.

StepSecurity's technical analysis revealed careful pre-attack preparation: the typosquatted “proc-macro2” fork and the impersonating publisher account were both registered immediately before the poisoned “arrayref” release. Wiz linked the incident to Sapphire Sleet based on substantial infrastructure overlap with two prior NPM supply chain attacks—Axios (April) and Mastra (June). Specifically, the Rust payloads beaconed to the same command-and-control (C2) endpoint used in the Mastra campaign, generated C2 traffic to an IP previously observed in the Axios operation, and relied on Hostwinds LLC address space across all three incidents. Organizations investigating exposure can probe suspicious egress destinations with a port scanner or examine the hosting range via a WHOIS lookup to identify additional Sapphire Sleet infrastructure.

The campaign underscores how nation-state actors are increasingly weaponizing typosquatting and account takeovers against language-specific package registries beyond NPM and PyPI. Because the attack bypassed normal code review by injecting logic into a build-time script and circumvented transport-layer security checks, defenders are advised to pin crates to exact versions, audit transitive dependencies, and require Cargo.lock integrity verification in CI pipelines. Given that the attacker disabled certificate validation to retrieve second-stage binaries, teams should also confirm their build environments enforce strict SSL/TLS checker validation to prevent similar man-in-the-middle code execution during compilation.