North Korea poisoned the Rust ecosystem. Your build pipeline ran the payload.
On August 20, 2026, the maintainer account for arrayref, one of the most widely used Rust crates with over 245 million downloads, was compromised. Malicious versions of three crates were published: arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9. The Rust Security Response Team detected and removed all three within 107 minutes. But by then, thousands of CI pipelines had already run the payload.
How the attack worked
The attack did not modify the library code. Each poisoned release added a single new dependency: proc-macro1, a typosquat of the legitimate proc-macro2 crate. The library source of proc-macro1 was a genuine copy of proc-macro2, so builds completed normally and returned correct results. The malicious code lived in proc-macro1's build script, which downloaded and executed a remote binary. In Rust, build scripts run automatically during cargo build, with no function call required from your code. If your project resolved the poisoned version of any of the three crates, the payload ran.
The DPRK connection
Wiz analyzed the attack and documented significant overlap with DPRK-attributed supply chain campaigns: the build-script dropper technique, the typosquat pattern, and infrastructure indicators. The Rust Security Response Team's post-mortem noted that the maintainer did not act maliciously and that his machine or credentials were almost certainly compromised. This is consistent with DPRK tradecraft of targeting individual developers rather than attacking registries directly.
What you need to check right now
If you run any Rust project: check your cargo.lock for arrayref 0.3.10, internment 0.8.7, or append-only-vec 0.1.9. If any of these versions appear, treat the build environment as potentially compromised. Review CI build logs from August 20 for anomalous outbound network connections during the build phase. Rotate any secrets accessible from the build environment. Update to the latest clean versions.
The wider pattern
This is the third confirmed DPRK supply chain operation against open source ecosystems in 18 months, following npm and PyPI campaigns. The technique is evolving: build-time execution is harder to detect than runtime execution because most SAST tools scan library code, not build scripts. The 107-minute response from the Rust Security Response Team was fast. For a crate with 245 million downloads, even a short window means the payload reached a significant number of build environments. Start treating build scripts in your dependency tree as attack surface.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you run Rust in production and want to audit your dependency exposure.