arrayref

Date (as written): 2026-08
Year: 2026
Actors (as written): Sapphire Sleet
Actor pages: Sapphire Sleet
Tags (as written): SupplyChain Technology

Source entries (3)

lazarus.day

arrayref · 2026-08

On August 20, 2026, attackers used a compromised crates.io maintainer account to publish malicious versions of arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 that pulled the typosquatted proc-macro1 build-time dropper. Building an affected Rust project automatically downloaded and executed a cross-platform backdoor, exposing developer workstations and CI runners; crates.io removed the releases, restored maliciously yanked clean versions, and locked the affected account. Wiz found significant infrastructure overlap with DPRK-linked Mastra/Sapphire Sleet and UNC1069 activity.

https://lazarus.day/incidents/arrayref/

Hackmageddon cyber attacks timelines (Paolo Passeri)

Rust developers using the arrayref, append-only-vec, and internment crates · 2026-08-20

Researchers find suspected North Korean threat actors compromise Rust crate maintainer accounts and publish a malicious typosquat installing infostealer malware during builds. [Date Occurred: 20/08/2026; Date Discovered: 20/08/2026]

https://www.hackmageddon.com/2026/09/17/16-31-august-2026-cyber-attacks-timeline/

https://www.bleepingcomputer.com/news/security/hackers-poison-arrayref-rust-crate-to-push-infostealer-malware/

Aikido Security blog

Popular Rust crates arrayref, append-only-vec, and internment compromised in Supply Chain Attack · Aug 20, 2026

Popular Rust crates arrayref, append-only-vec, and internment compromised in Supply Chain Attack ... This campaign looks very similar to the Axios and Mastra compromises we've seen on npm, both tied to DPRK / Sapphire Sleet. The same threat actor is now moving into Rust.

https://www.aikido.dev/blog/two-popular-rust-crates-arrayref-and-append-only-vec-compromised-in-supply-chain-attack

Suggest a correction on GitHub