Backdoored Rust packages hit crates.io, exposing developers to malware at build time
Summary
Three Rust packages, including the popular arrayref, were found to contain backdoors that executed during the build process. The malicious packages relied on a typosquatted dependency that downloaded and executed a second-stage payload, with infrastructure links to North Korean threat actors.
IFF Assessment
This article reports a supply chain attack that compromises widely used software packages, posing a direct threat to developers and the integrity of their software.
Defender Context
This incident highlights the critical risk of supply chain attacks within software development. Defenders need to implement robust dependency scanning and verification processes, monitor for typosquatting attempts, and be aware of infrastructure overlaps with known threat actors to mitigate similar build-time compromises.