Three Rust crates hijacked in 107-minute attack on Solana ecosystem

Three widely used Rust packages were hijacked on Aug. 20, injecting malware into developer builds and exposing Solana ecosystem components to potential remote code execution.

The Rust Security Response Team confirmed the compromise, saying a new version of the arrayref crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. Researchers at Wiz, a cloud security firm, linked the attack to North Korean cyber actors tracked as Sapphire Sleet.

The compromised crates — arrayref, internment, and append-only-vec — were published to the crates.io registry in a 23-minute window between 07:15 and 07:38 UTC. Each contained a dependency on a poisoned version of proc-macro1, which activated a build script during Cargo builds that downloaded and executed malware. The malicious versions were live for 86 to 107 minutes before being yanked from the registry. The previous clean version of arrayref alone had accumulated between 152 million and 245 million lifetime downloads.

The arrayref crate is a foundational component in Solana's ecosystem, used in token interfaces and core blockchain infrastructure. No widespread exploits have been publicly reported, but developers who built projects during the exposure window are being advised to inspect their Cargo registry cache and pin dependencies below the compromised releases.

Why Solana sits at the center of the concern

The other affected crates — internment and append-only-vec — similarly appear in dependency chains for projects building on Solana and, to a lesser extent, Ethereum tooling. The risks from successful infection included remote code execution and credential theft, meaning any developer whose build process pulled the poisoned versions could have had their machine fully compromised.

North Korean fingerprints

Wiz researchers linked the attack to Sapphire Sleet, a North Korean state-sponsored group. The attribution fits a well-documented pattern of North Korean groups systematically targeting cryptocurrency infrastructure through supply chain compromises, social engineering of developers, and trojanized tools. StepSecurity's analysis showed the threat actor created typosquatted versions of proc-macro2 and an impersonating account right before the poisoned arrayref release was published. The payloads beacon to an endpoint used in the Mastra attack, and command-and-control traffic was recorded to an IP used in the Axios campaign.

The incident exposes the fragility of open-source dependency chains in blockchain infrastructure. For Solana-based projects, the attack highlights the need for rigorous dependency pinning and supply chain verification. If exploited, the vulnerability could have led to significant fund losses across multiple Solana-based DeFi protocols and dApps, potentially triggering sell-offs in SOL and related tokens.

This article is for informational purposes only and does not constitute investment advice.