Researchers tie the arrayref Rust crate hijack to North Korean hackers

Wiz says the supply chain attack that poisoned arrayref, a Rust package present in roughly three-quarters of environments running Rust, has drawn comparisons with recent North Korean operations. 

The harmful update hid a backdoor that steals login information inside a code designed to run automatically when users compile projects. So, anyone who compiled a project on Thursday may now have exposed their computer and secrets.

Why is North Korea being blamed for the hack on arrayref? 

Wiz researchers Rami McCarthy and Benjamin Read have published a report in which they noted that the arrayref payload beacons to a command-and-control path, /49890878, that also appears in the Mastra campaign. 

Microsoft links the Mastra campaign to a North Korean hacking group it calls Sapphire Sleet. 

The internet address (IP) used in the arrayref attack shares the same security certificate as another address used in Mastra. Also, a victim who reported suspicious activity flagged an IP that Google Cloud saw in the axios npm attack. 

… Continue reading the full article at the original source below.