A backdoor that fires at cargo build: the arrayref poisoning puts your build boxes in scope

On August 20, 2026, malicious versions of three Rust crates were published to crates.io: arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9, each carrying a new typosquatted dependency called proc-macro1 whose build script downloads and executes a remote binary ^[1][2]. Because Cargo runs build scripts during compilation, building an affected project was enough to execute the payload, which moves the exposed asset from the artifact you shipped to the machine that compiled it ^[3].

The blast radius is the uncomfortable part. According to Wiz, arrayref appears in more than 35% of all environments and in three quarters of all environments where Rust is present ^[4][5]. proc-macro1 is a typosquat of proc-macro2, a crate with more than 154 million downloads, and it was the first dependency ever added to arrayref in the crate's ten-year history ^[6][7]. That single line in Cargo.toml is the whole trick ^[8].

The build script reconstructs a command-and-control URL from Base64 fragments, one example being https://23.254.165[.]112:9089/, disables TLS certificate validation with a custom AcceptAll verifier, downloads a payload matched to the host OS and architecture, writes it to /tmp/rust-setup on Unix or %TEMP%\rust-setup.ps1 on Windows, and runs it with the beacon address as an argument ^[9]. The build then completes and the package works normally, which is why nobody noticed at compile time ^[10]. Second-stage support covers x86_64 Linux, Windows and macOS plus aarch64 macOS ^[11].

The implant beacons over HTTPS POST to the path /49890878, exfiltrating host information and stolen credentials as Base64-encoded JSON ^[12]. It reads saved logins from Chrome, Brave and Edge by querying their SQLite login databases ^[13]. It persists through a Registry Run key on Windows, a LaunchAgent on macOS, or a systemd user service on Linux ^[14]. It takes four commands: kill, minicfg, startup and runscript ^[15]. Its configuration is encrypted with AES-128-GCM under the hardcoded key "i am botking", and commands are authenticated with an embedded RSA-2048 private key ^[16]. If the primary C2 is unreachable it falls back to a domain generation algorithm producing ten .com domains every five days, which Wiz says are not currently registered ^[17]. That is roughly 730 candidate domains a year sitting unclaimed ^[18].

Wiz ties the operation to North Korean activity on two threads: the /49890878 beacon path was used in the Mastra campaign, which Microsoft attributed to DPRK actor Sapphire Sleet, and the arrayref beacon IP shares an SSL issuer string with 23.254.167[.]13, also used in Mastra ^[19][20]. Wiz's headline places the overlap alongside axios as well ^[21].

Remediation is not a version bump. Wiz's guidance is to treat any developer workstation or CI runner that built an affected project as compromised, rotate every credential, token and key reachable from it including CI secrets and signing keys, and rebuild any artifacts produced after exposure from clean sources ^[22]. Reset browser-stored passwords and revoke the associated sessions ^[23]. Delete /tmp/rust-setup, %TEMP%\rust-setup.ps1 and %TEMP%\rust-setup-launch.vbs, then check for unrecognised systemd user services, HKCU Run entries and LaunchAgents ^[24].

One operational detail deserves repeating: the attack used yanking to drive upgrades, so Wiz advises treating a sudden yank of several stable versions of a long-lived crate as a reason to investigate rather than to upgrade ^[25]. Grep Cargo.lock across your repositories for the malicious versions and for all six attacker-controlled crate names ^[26].