Rust Project Warns of New Attacks Copying North Korea's Playbook

The Rust project told prominent contributors and crate maintainers Sept. 17 to be wary of unsolicited video calls, warning that someone is using fake job, contract and project offers to get malware onto their computers or hijack their crates.io accounts. Adam Harvey, writing on behalf of the crates.io team and its security response working group, said the campaign is ongoing and follows the same pattern used in an Aug. 20 attack that compromised three widely downloaded crates.

What happened on Aug. 20

That attack published malicious versions of arrayref, internment and append-only-vec, crates with roughly 245 million, 14.4 million and 4.5 million downloads respectively, according to JFrog Security Research. The malicious versions stayed live for 86 to 107 minutes before the crates.io team pulled them. Rust's own Aug. 20 advisory said it does not believe arrayref maintainer droundy acted maliciously, and that the account's "computer or credentials are likely compromised." The attacker published under the name dtolney while distributing a typosquat of the proc-macro2 crate called proc-macro1.

How the payload worked

JFrog's analysis found the malicious build.rs script used Base64-encoded, obfuscated command-and-control URLs and disabled TLS certificate verification, accepting self-signed certificates so its download would not fail. On Linux and macOS it wrote a payload to /tmp/rust-setup and ran it detached; on Windows it launched a PowerShell script, rust-setup.ps1, through a VBS wrapper that bypassed execution policy. Because the malicious code sat in a build script, compiling a project that resolved the poisoned dependency was enough to run it. Crates.io also deleted six attacker-owned crates that supported the operation, including proc-macro1 itself, proc-macro-en, aovine, arone, aronenao and tinymember, none of which had meaningful download counts before they were pulled.

The North Korea connection

Security firm Wiz found that the attack's command-and-control traffic beaconed to a path, /49890878, previously used in the Mastra campaign, which Microsoft has attributed to Sapphire Sleet, a group it links to North Korea. Wiz also found a victim's traffic reaching 23.254.167.216, an IP address that appeared in Google Cloud's own analysis of a separate npm attack, UNC1069, which Mandiant has linked to North Korea. Both campaigns used infrastructure inside the same 23.254.164.0/23 range at hosting provider Hostwinds LLC, Wiz said, down to a shared SSL certificate issuer.

That overlap ties the Aug. 20 crates.io attack to North Korean infrastructure with some confidence. It does not, on its own, confirm who is behind the new wave of video-call approaches the Rust project flagged Sept. 17. The Rust post describes the current campaign only as using "attacks known to be used by the DPRK," a description of technique rather than a fresh attribution.

What the new approach looks like

Harvey's post described attackers setting up video calls under the pretext of a job, a project or a contract, then using the call to get a target to install something, such as a supposedly missing audio codec, or to run a command pasted onto their clipboard. The attackers back the approach with fabricated but plausible-looking company profiles and LinkedIn presences, meant to survive a quick check before a call is accepted.

Crate	Malicious version live	Downloads
arrayref 0.3.10	86 minutes	~245 million
internment 0.8.7	90 minutes	~14.4 million
append-only-vec 0.1.9	107 minutes	~4.5 million

1. arrayref 0.3.10245 millions of downloads
2. internment 0.8.714.4 millions of downloads
3. append-only-vec 0.1.94.5 millions of downloads

Source: JFrog Security Research, accessed 2026-09-18

Why Rust is a target now

Rust's growing footprint gives an attacker more to aim at. Microsoft made Rust a tier-1 language inside the company on Sept. 11, putting it alongside C++ and C# for internal development, with more than 100 Microsoft repositories already building against the new backend. A widely used crate compromised for even 86 minutes now reaches a correspondingly larger set of build pipelines. Rust joins other fast-growing open-source projects, including OpenClaw, whose maintainers spent the past year fighting fake pull requests and automated submission floods, in absorbing the kind of coordinated abuse that comes with scale.

What would change this read

The technique the Rust project flagged Sept. 17, a fake job or contract call used to get a target to install something or run a pasted command, is not exclusive to North Korean operators; researchers have documented similar lures from financially motivated criminal groups with no state connection. The Rust post itself frames the description as a technique match, not a fresh forensic finding. What would confirm this new wave as the same actor behind the Aug. 20 attack is an infrastructure match: the same Hostwinds LLC address range, the same command-and-control path structure, or recovery of a second-stage payload resembling the one JFrog could not retrieve from the arrayref compromise. Absent that, the accurate description is a campaign using a DPRK-associated playbook, not one attributed by name to DPRK operators.

crates.io has not said how many accounts, beyond droundy's, it has reviewed for compromise since Aug. 20, or whether any of the new video-call approaches it warned about Sept. 17 have already succeeded. Harvey's post asks anyone contacted this way to verify calls happen on platforms they control, audit their accounts for unauthorized access, enable multi-factor authentication, and report concerns to help@crates.io or security@rust-lang.org.