Popular Rust Packages With 244M Downloads Compromised in Supply Chain Attack — Threadlinqs Intelligence
As of 2026-08-20, Popular Rust Packages With 244M Downloads Compromised in Supply Chain Attack is a critical-severity supply chain threat attributed to UNC1069 (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 31 indicators of compromise.
Threat ID: TL-2026-2083 · Severity: CRITICAL · Status: CONTAINED · Category: SUPPLY_CHAIN
Attribution: UNC1069 · North Korea · ESPIONAGE
On August 20, 2026, the crates.io account of Andrew Gallant (BurntSushi, creator of ripgrep) was compromised via stolen credentials, leading to hijacked versions of arrayref (244M downloads),
On 2026-08-20, a sophisticated supply chain attack targeted the Rust crates.io ecosystem through account compromise of Andrew Gallant (crates.io user droundy), the widely-respected maintainer of the ripgrep tool and multiple popular crates. The attacker, operating from the crates.io typosquat account dtolney (impersonating David Tolnay, dtolnay), first published the typosquat crate proc-macro1 — a deliberate misspelling of the legitimate proc-macro2 crate (154M+ downloads). The malicious crate copied the legitimate crate's description, documentation, and author metadata (forged as rchaitm@gmail.com) to appear trustworthy, while its build.rs contained the entire payload delivery mechanism.
The attack chain unfolded across approximately 107 minutes. At 07:10 UTC, proc-macro1@1.0.107 was published. Within minutes, the compromised droundy account published arrayref@0.3.10 (07:15 UTC), internment@0.8.7 (07:34 UTC), and append-only-vec@0.1.9 (07:37 UTC) — each with a single injected line in Cargo.toml declaring proc-macro1 as a dependency. Because arrayref had never added a dependency in its ten-year history, this sudden change was a red flag that tipped off researchers. The library source code of the legitimate crates remained untouched, meaning manual code review would not have caught the compromise.
The proc-macro1 build.rs executed automatically whenever Cargo compiled any project depending on the tainted versions. It reconstructed two C2 URLs from base64-encoded fragments (aHR0cHM6Ly8=, MjMuMjU0Lg==, MTY1Lg==, MTEyOg==, OTA4OS8=, etc.) to evade static string-based detection. The decoded URLs pointed to a Hostwinds VPS at 23.254.165.112:9089 for payload delivery and 23.254.165.112:443 for C2 beaconing. TLS certificate validation was disabled via a custom AcceptAll verifier.
Based on the victim's operating system and architecture (Linux x86_64, Windows x86_64, macOS x86_64, macOS aarch64), the script downloaded a matching stage-2 payload (rust-crate_0.1.0 through 0.4.0). On Unix systems, the payload was written to /tmp/rust-setup, made executable, and spawned as a detached background process with std::mem::forget(child) to escape Cargo's job object. On Windows, a PowerShell script was launched via a VBS wrapper under wscript.exe, also designed to escape the build process's lifetime.
The stage-2 payload was a full-featured Rust backdoor communicating via HTTPS POST to the endpoint /49890878. It exfiltrated host information and stolen credentials as base64-encoded JSON on a configurable beacon interval. Credential theft targeted Chromium-based browsers (Chrome, Brave, Edge) by querying their SQLite login databases — extracting origin URLs, usernames, and password values. It also accessed Local Extension Settings storage, which is commonly used by browser-based cryptocurrency wallet extensions to store seed phrases and private keys.
Persistence mechanisms were platform-specific: a LaunchAgent plist written to ~/Library/LaunchAgents with RunAtLoad on macOS; a systemd user service dropping MonoService and MonoXpc executables to $HOME/.config/AzureKits and $HOME/.config/ServiceKit on Linux; and a Registry Run key on Windows. Configuration was protected with AES-128-GCM (hardcoded key: 'i am botking'), and C2 commands were authenticated via an embedded RSA-2048 private key. The implant supported four commands: kill (terminate), minicfg (reconfigure C2 and beacon interval), startup (install persistence), and runscript (download and execute arbitrary shell/PowerShell scripts). If the primary C2 became unreachable, a DGA fallback generated 10 algorithmic .com domains every 5 days (none were registered at time of analysis).
The attack was detected by Aikido Security's automated pipeline, which flagged proc-macro1 as a new package downloading and executing remote files. Aikido escalated within the same hour when two trusted packages from the same maintainer suddenly added proc-macro1 as a dependency. Nextron Systems independently disco
Weaknesses (CWE)
CWE-494, CWE-506, CWE-522, CWE-829, CWE-1104
Target sectors: software-development, technology, cryptocurrency, open-source
Target regions: Global
Detections & IOCs
As of 2026-08-25, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 31 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
8 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1583.003, T1586.002, T1587.001, T1608.001, T1585, T1195, T1195.001, T1204.002, T1059.004, T1059.001
