Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

This supply chain attack involved publishing malicious versions of three Rust crates to crates.io that introduced a typosquatted dependency named proc-macro1. The malicious build script downloads and executes a remote binary at compile time, deploying a backdoor capable of beaconing to C2 servers over HTTPS, exfiltrating system and browser data, enumerating installed applications, and establishing persistence through multiple OS-specific methods. The campaign infrastructure shows significant overlap with North Korean threat actor STARDUST CHOLLIMA, including shared command and control endpoint patterns with the Mastra campaign and IP addresses used in the axios npm attack.

The malicious crates enable attackers to gain persistent backdoor access to affected systems, allowing exfiltration of sensitive host and browser data, enumeration of installed applications, and persistence via Registry Run keys, LaunchAgents, or systemd user services. This compromises the confidentiality and integrity of affected systems and any sensitive data stored or accessed on them. The supply chain nature of the attack increases the risk of widespread impact among Rust developers and users who consume these crates.

No official patch or remediation guidance is currently provided. Patch status is not yet confirmed—users should consult vendor advisories or crates.io announcements for updates. Until clean versions are available, users should avoid using the affected crate versions and verify dependencies for typosquatting or unexpected build scripts. Monitoring for indicators of compromise such as the listed domain (hwsrv-798836.hostwindsdns.com) and associated file hashes may assist in detection. Rebuilding projects with verified clean dependencies is recommended once clean versions are released.