North Korea-Linked Hackers Target Rust Software Supply Chain Arabian Post

(MENAFN- The Arabian Post) clearfix"> Cybersecurity investigators have linked a supply-chain attack on three widely used Rust software packages to infrastructure associated with North Korean threat actors, raising fresh concerns over attempts to compromise developers before applications are even built.

Malicious versions of arrayref, internment and append-only-vec were published on crates. io, the official package registry for the Rust programming language, on August 20. The altered releases introduced a dependency called proc-macro1, designed to resemble the legitimate and widely used proc-macro2 package.

The affected versions were arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9. Investigators found that proc-macro1 contained a build script capable of downloading and executing a second-stage payload automatically when developers compiled software containing one of the compromised packages.

MENAFN27082026000152002308ID1111584610