Researchers say malicious code in compromised Rust packages is tied to North Korean hacking activity. The reported attack involves a poisoned Rust component that alters an arrayref to introduce an additional dependency. That dependency is designed to retrieve and run a malicious payload from an external server, effectively turning the altered package into a delivery mechanism.
Both outlets describe the technique as part of a supply chain compromise, where attackers compromise legitimate software distribution to infect downstream users. Infosecurity Magazine characterizes the activity as a backdoor within compromised Rust packages and links it to earlier North Korean supply chain operations. SecurityWeek similarly reports that the poisoned package behavior is associated with North Korean hackers, based on attribution by researchers.
While the sources focus on the same incident, their emphasis differs: SecurityWeek highlights the specific implementation pattern (the modified arrayref and remote payload fetching), while Infosecurity Magazine emphasizes the broader attribution to North Korean supply chain attacks and the presence of a backdoor in the affected Rust packages.
