Hackers compromised the maintainer account behind the widely used Rust crate arrayref, introducing malware that executes on developers' systems during compilation, affecting over 53 million downloads.
Supply-Chain Attack
The attacker injected a dependency on a package called proc-macro1, a typosquat impersonating the popular proc-macro2 crate, while retaining the rest of the upstream source code completely unchanged. This malicious dependency was introduced in arrayref version 0.3.10, as well as in append-only-vec version 0.1.9 and internment version 0.8.7.
Malware Behavior
A script in proc-macro1, named ‘build.rs,’ is automatically executed during compilation, reconstructing its infrastructure from base64-encoded fragments and selecting a payload that matches the host OS. The malware writes to /tmp/rust-setup on Unix systems, marks it executable, and launches it as a detached process. On Windows, it creates %TEMP% ust-setup.ps1 and uses a hidden wscript.exe and VBS launcher to keep the process running.
The payload receives an address as an argument, believed to be a command-and-control address. The malware collects credentials from Google Chrome, Brave, and Edge browsers by querying SQLite login databases. Persistence is established via the Registry Run key on Windows, LaunchAgent on macOS, and systemd on Linux.
Timeline and Impact
The attack started at 01:17 UTC on August 20, when a GitHub account impersonating prominent Rust developer David Tolnay was created. The attacker published proc-macro1@1.0.106, a benign copy of proc-macro2, followed by a malicious update through version 1.0.107. At 07:15, arrayref 0.3.10 was published through the legitimate droundy (David Roundy) account.
The potential impact of this supply-chain attack is significant, as arrayref alone has more than 245 million lifetime downloads, while the collective count for append-only-vec and internment is nearly 19 million installs. Projects using arrayref include blake3, Rust GUI frameworks such as egui, eframe, and iced, and components used in Ethereum and Solana.
Recommendations
Developers who installed either during the exposure window of nearly 1.5 hours should assume compromise. Recommended checks include searching Cargo.lock files, looking for the dropped files, and reviewing traffic to 23.254.165[.]112 on ports 9089 and 443. Where compromise is confirmed, it is recommended to rotate all accessible credentials, CI tokens, signing keys, and other secrets, and rebuild the environment from safe backups.
Clean projects should pin a known-safe version of the affected dependencies until the maintainer situation is clarified and resolved. Once attackers have valid credentials, only 37% of their actions are blocked, highlighting the importance of prompt action in case of a breach.
The incident highlights the need for vigilance and swift response in the face of supply-chain attacks, as well as the importance of secure coding practices and dependency management.
- Arrayref: A popular Rust library with over 53 million downloads in the past 90 days.
- Proc-macro1: A malicious package impersonating proc-macro2, used to inject malware into the build process.
- Supply-chain attack: A type of attack where an attacker compromises a dependency or library to inject malware into a project.
For more information on this incident and recommendations for securing your projects, refer to the analyses by StepSecurity, SafeDep, and Aikido, as well as the report from Wiz.
Once attackers have valid credentials, only 37% of their actions are blocked, highlighting the importance of prompt action in case of a breach.
This incident serves as a reminder of the importance of vigilance and secure coding practices in the development community.
Source: BleepingComputer