Sapphire

April

Sanctum

Security

Read

Wiz says the supply chain attack that poisoned arrayref, a Rust package present in roughly three-quarters of environments running Rust, has drawn comparisons with recent North Korean operations.&nbsp;
The harmful update hid a backdoor that steals login information inside a code designed to run automatically when users compile projects. So, anyone who compiled a project on Thursday may now have exposed their computer and secrets.
<h3 id="span-style-font-weight-400-why-is-north-korea-being-blamed-for-the-hack-on-arrayref-span">Why is North Korea being blamed for the hack on arrayref?&nbsp;</h3>
Wiz researchers Rami McCarthy and Benjamin Read have <a href="https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns" rel="noopener noreferrer nofollow">published a report</a> in which they noted that the arrayref payload beacons to a command-and-control path, /49890878, that also appears in the Mastra campaign.&nbsp;
Microsoft links the Mastra campaign to a North Korean hacking group it calls Sapphire Sleet.&nbsp;
The internet address (IP) used in the arrayref attack shares the same security certificate as another address used in Mastra. Also, a victim who reported suspicious activity flagged an IP that Google Cloud saw in the axios npm attack.&nbsp;
Mandiant says that the attack was done by a North Korean group called UNC1069. Both attacks used the same hosting company, Hostwinds.
The attack was hard to notice because it changed very little. Ilyas Makari, a security researcher from Aikido, <a href="https://www.aikido.dev/blog/two-popular-rust-crates-arrayref-and-append-only-vec-compromised-in-supply-chain-attack" rel="noopener noreferrer nofollow">found</a> that the actual code inside the three Rust packages, arrayref, internment, and append-only-vec, was not altered. The only change was one new dependency added to each package’s list called proc-macro1.
This name is a misspelling of the popular proc-macro2 crate, which has over 154 million downloads. The fake crate even includes the real proc-macro2 code, so the software still builds and passes all tests.&nbsp;
The harmful part was hidden in the build script.&nbsp;
Cargo runs build scripts automatically at compile time, so, as the Rust Security Response Team <a href="https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/" rel="noopener noreferrer nofollow">spelled out in its advisory</a>, merely compiling a project that pulled the bad version was enough to trigger the attack.&nbsp;
Once running, the second stage of the attack stole saved passwords from Chrome, Brave, and Edge browsers and installed itself so it would survive computer restarts on Windows, Mac, and Linux.
<h3 id="span-style-font-weight-400-the-largest-rust-compromise-by-download-count-span">The largest Rust compromise by download count</h3>
Aikido stated that this attack is the biggest Rust crate compromise it has seen, measured by downloads, with arrayref, which is used in tools for Solana and Ethereum, sitting at about 244 million total downloads. The exposure was reportedly live for 86 minutes before deletion.&nbsp;
The team said Nextron Systems made the initial report. And once the attack was discovered, the team unyanked the clean versions and locked the maintainer’s account.&nbsp;
The Rust team said it does not believe the author acted maliciously, assessing instead that their machine or credentials were compromised.&nbsp;
Notably, <a href="https://aws.amazon.com/blogs/security/amazon-identifies-north-korean-hacker-group-behind-open-source-supply-chain-attacks/" rel="noopener noreferrer nofollow">Amazon disclosed</a> on July 29 that it had linked a string of <a href="https://www.cryptopolitan.com/hijacked-npm-libraries-ethereum-c2/" rel="noopener noreferrer nofollow">npm library compromises</a> to a single DPRK-linked actor. TRM Labs also <a href="https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks" rel="noopener noreferrer nofollow">reported</a> that North Korean groups accounted for about 76% of all crypto hack value in 2026 through April (roughly $577 million).&nbsp;
Black Hat researcher Vangelis Stykas has said he&nbsp;<a href="https://www.cryptopolitan.com/north-korea-hackers-ai-tools-widen-reach/" rel="noopener noreferrer nofollow">tracked North Korean hackers</a> into 1,640 companies across 57 countries.&nbsp;He found that they often bait developers with fake job offers that install malware, similar to the poisoned build dependency in this case.&nbsp;
Don’t just read crypto news. Understand it. Subscribe to our newsletter. <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">It's free</a>.

Researchers tie the arrayref Rust crate hijack to North Korean hackers

Table of Contents

Cryptopolitan_News

Other articles published on Aug 20, 2026

Join our free newsletter for daily crypto updates!