This supply chain attack involved publishing malicious versions of three Rust crates to crates.io that introduced a typosquatted dependency named proc-macro1. The malicious build script downloads and executes a remote binary during compilation, deploying a backdoor capable of beaconing to C2 servers over HTTPS, exfiltrating system and browser data, enumerating installed applications, and establishing persistence via common OS mechanisms. The infrastructure and tactics show significant overlap with North Korean threat actor STARDUST CHOLLIMA, including shared command and control patterns with the Mastra campaign and IP addresses previously used in other DPRK-linked supply chain attacks such as the axios npm incident.

The malicious crates enable attackers to gain persistent backdoor access to affected systems, allowing them to exfiltrate sensitive host and browser data, enumerate installed applications, and maintain persistence through multiple OS-specific methods. This compromises the confidentiality and integrity of the affected systems and potentially any sensitive data stored or accessed on them. The supply chain nature of the attack increases the risk of widespread impact among Rust developers and users who consume these crates.

No official patch or remediation guidance is provided in the available data. Patch status is not yet confirmed — check the vendor advisory or crates.io announcements for current remediation guidance. Users should avoid using the affected crate versions and verify dependencies for typosquatting or unexpected build scripts. Monitoring for indicators of compromise such as the listed domain and file hashes may assist in detection. Given the supply chain nature, rebuilding projects with verified clean dependencies is recommended once clean versions are available.