Rust Supply Chain Attack Linked to North Korean Hackers

On August 20, 2026, North Korean hackers associated with the Sapphire Sleet group conducted a supply chain attack on the Rust ecosystem by publishing a poisoned version (0.3.6) of the widely used arrayref crate. This version introduced a direct dependency on a maliciously crafted proc-macro1 package that impersonated the legitimate proc-macro2 crate. The malicious package contained a build.rs script designed to download a platform-specific second-stage binary over TLS, deliberately disabling certificate validation to facilitate the attack. Additional poisoned versions of related crates (internment and append-only-vec) and attacker-owned crates referenced the same malicious dependency. The Rust Security Response Team removed all malicious packages within approximately 86 minutes and restored clean versions. Analysis linked the attack infrastructure to the Sapphire Sleet threat actor, known for previous supply chain attacks on npm packages. The legitimate maintainer's credentials were likely compromised, but no evidence of actual exploitation was found.

The attack could have allowed execution of malicious code during the build process of Rust projects that used the poisoned arrayref crate version or related crates, potentially leading to compromise of developer environments or downstream software. However, the malicious packages were removed quickly (within 86 minutes), and the Rust Security Response Team found no evidence of actual usage of the malicious crates. The legitimate maintainer's account was likely compromised, indicating a risk to supply chain trust. The attack demonstrates the potential for supply chain compromise in open source ecosystems but no confirmed exploitation impact has been reported.

The Rust Security Response Team promptly removed the malicious packages and restored clean versions of the affected crates. Users should ensure they are using clean, official versions of arrayref and related crates. There is no indication that further action is required by users beyond updating to the clean versions. The incident highlights the importance of monitoring supply chain components and maintaining credential security for maintainers. Patch status is effectively managed by the Rust security team through removal of malicious packages.