Backdoored Rust Packages Expose Developers to Malware During Compilation On August 20, malicious versions of three Rust packages [email protected], [email protected], and [email protected] were published to the crates.io registry, embedding a backdoor that activated automatically during project compilation. The attack, discovered by security researchers at Wiz, exploited Rust’s build process, where the payload executed without requiring developers to run suspicious code or call affected functions. The compromised packages introduced a dependency on proc-macro1, a typosquat of the legitimate proc-macro2 crate. During compilation, the build script reconstructed a command-and-control (C2) URL from Base64 fragments, disabled TLS validation, and downloaded a platform-specific payload for Linux, Windows, or macOS (including Apple Silicon). The malware collected system details, browser credentials (Chrome, Brave, Edge), and installed applications, while also establishing persistence via registry keys, LaunchAgents, or systemd services. With arrayref alone recording 245 million all-time downloads (53.7 million in the last 90 days), the exposure window for affected versions lasted between 86 and 107 minutes before removal. The attack shares infrastructure with recent supply-chain campaigns linked to North Korean threat actors, including overlapping C2 paths and SSL certificate issuers tied to operations attributed to groups like Sapphire Sleet. The payload featured a fallback domain-generation mechanism, creating 10 new .com domains every five days if the primary C2 became unavailable. Wiz recommended treating any developer workstation or CI runner that built affected projects as compromised, urging rotation of credentials, tokens, and keys, and rebuilding artifacts from clean sources.