Security researchers at Wiz say the supply chain attack that poisoned arrayref — a Rust package present in roughly three-quarters of environments running Rust — has drawn comparisons with recent North Korean operations.

The harmful update hid a backdoor that steals login information inside code designed to run automatically when users compile projects. As a result, anyone who compiled a project on Thursday may have exposed their computer and its secrets.

Why North Korea is being blamed

Wiz researchers Rami McCarthy and Benjamin Read have published a report noting that the arrayref payload beacons to a command-and-control path, /49890878, which also appears in the Mastra campaign. Microsoft links the Mastra campaign to a North Korean hacking group it calls Sapphire Sleet, which Microsoft has previously described as a financially motivated operation that steals cryptocurrency through fake recruiting lures and other social engineering.

Infrastructure overlap of this kind — matching command-and-control paths, shared security certificates, and common hosting providers — is a standard way researchers connect separate campaigns to the same operators, though it falls short of formal government attribution.

The internet address (IP) used in the arrayref attack shares the same security certificate as another address used in Mastra. In addition, a victim who reported suspicious activity flagged an IP that Google Cloud saw in the axios npm attack. Mandiant says that attack was carried out by a North Korean group called UNC1069. Both attacks used the same hosting company, Hostwinds.

A minimal change that was hard to notice

The attack was difficult to detect because it changed very little. Ilyas Makari, a security researcher from Aikido, found that the actual code inside the three Rust packages — arrayref, internment, and append-only-vec — was not altered. The only change was a single new dependency, called proc-macro1, added to each package's list.

That name is a misspelling of the popular proc-macro2 crate, which has over 154 million downloads. Mimicking the name of a widely trusted package is a long-standing tactic in open-source registries such as npm and PyPI, where updates are published without manual code review. The fake crate even includes the real proc-macro2 code, so the software still builds and passes all tests.

The harmful part was hidden in the build script. Cargo runs build scripts automatically at compile time, so, as the Rust Security Response Team spelled out in its advisory, merely compiling a project that pulled the bad version was enough to trigger the attack. Because Cargo records exact dependency versions in each project's Cargo.lock, developers can search that file for proc-macro1 to check whether a build pulled a tainted version.

Once running, the second stage of the attack stole saved passwords from Chrome, Brave, and Edge browsers and installed itself so it would survive computer restarts on Windows, Mac, and Linux.

The largest Rust compromise by download count

Aikido stated that this attack is the biggest Rust crate compromise it has seen, measured by downloads. arrayref, which is used in tools for Solana and Ethereum, sits at about 244 million total downloads. The exposure was reportedly live for 86 minutes before deletion.

The team said Nextron Systems made the initial report. Once the attack was discovered, the team unyanked the clean versions and locked the maintainer's account. The Rust team said it does not believe the author acted maliciously, assessing instead that their machine or credentials were compromised. Compromised maintainer accounts are a recurring weakness in open-source security: the 2024 XZ Utils backdoor, for example, also stemmed from an attacker obtaining a trusted maintainer role.

A wider pattern of DPRK activity

Amazon disclosed on July 29 that it had linked a string of npm library compromises to a single DPRK-linked actor. TRM Labs also reported that North Korean groups accounted for about 76% of all crypto hack value in 2026 through April — roughly $577 million.

Black Hat researcher Vangelis Stykas has said he tracked North Korean hackers into 1,640 companies across 57 countries. He found that they often bait developers with fake job offers that install malware, similar to the poisoned build dependency in this case.