Sapphire Sleet

A hijacked crates.io account added the first dependency arrayref has taken in ten years, and that dependency ran a backdoor at compile time; every machine that built an affected project during a ninety-minute window must be treated as compromised

The mechanism here is the whole story, and it is one Rust shares with every ecosystem that lets packages run code at install or build time. Build scripts execute during compilation, ahead of the parent crate's own code, so there is no "use the library carefully" defence: compiling was execution.

On 2026-08-20 an attacker with a compromised crates.io publisher account pushed malicious releases of three widely used crates. Wiz's summary: "On August 20, 2026, malicious versions of three Rust crates were published to crates.io: arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9. The malicious crates added a typosquatted dependency (proc-macro1) whose build script downloads and executes a remote binary. Notably, proc-macro1 was the first dependency added to arrayref in its ten-year history" (Wiz Research, 2026-08-20). That last clause is the tell that this was an account takeover rather than a maintainer turning hostile; a crate that has taken no dependency in a decade suddenly taking one, and taking one whose name is a single character away from the ubiquitous proc-macro2. The Rust Security Response Team reached the same conclusion: "We do not believe the author of arrayref to be acting maliciously" (The Rust Project, 2026-08-20), and credits discovery to the research team at Nextron Systems.

The exposure windows were short and are published per crate, "arrayref@0.3.10: published at 2026-08-20T07:15:00Z, deleted at 2026-08-20T08:41:40Z. Online for 86 minutes.", with internment online 90 minutes and append-only-vec 107 minutes, the three publications staggered across about 23 minutes rather than landing together. The team also removed the typosquat dependency and five further attacker-controlled crates, and locked the publisher account.

What ran. The build script reconstructs its command-and-control URL from encoded fragments, disables certificate validation for its own callback, and pulls a platform-specific second stage for 64-bit Linux, Windows and macOS including Apple silicon. The implant beacons over HTTPS, collects host and user details, enumerates installed applications, and queries the SQLite stores Chrome, Brave and Edge use for saved logins. That last point deserves precision, because Wiz corrected itself on it: "Edit: A prior version of this piece mistakenly stated that browser credentials were stolen. The queries only enumerate saved logins, they do not retrieve the encrypted credential material." Enumeration of which sites a developer has credentials for is materially different from taking the credentials, and this entry follows the corrected claim. Persistence is a registry run key on Windows, a launch agent on macOS or a user-scoped systemd service on Linux, and the command set covers reconfiguring the channel, running scripts synchronously or in the background, and terminating. Its resilience feature is worth noting for hunting: "Falls back to a Domain Generation Algorithm if the primary C2 is unreachable, generating 10 algorithmic .com domains every 5 days. Currently, the relevant domains do not appear to be registered." Unregistered today means the sinkhole opportunity is open and the blocking opportunity is not.

Attribution, per claiming vendor. Wiz states "The arrayref infrastructure substantially overlaps with operations attributed to recent North Korean actors", resting it on a beacon endpoint previously seen in the Mastra npm campaign, a shared TLS certificate issuer with Mastra infrastructure, a victim-reported address appearing in Google's analysis of the axios npm compromise, and both campaigns sitting in one hosting provider's address range. The attributions themselves belong to other vendors and should be carried as theirs: Microsoft says of Mastra that "Microsoft assesses with high confidence that this activity is attributable to Sapphire Sleet, a North Korean state actor that primarily targets the financial sector" (Microsoft Security Blog, 2026-06-17), while Google Threat Intelligence Group attributes the axios compromise to UNC1069 (Google Threat Intelligence Group, 2026-03-31). Those two designations resolve to the same cluster this store already tracks, so the overlap is with one actor seen twice rather than two whose relationship is itself unproven, which strengthens the read. Wiz's contribution is the infrastructure linkage, not the attribution.

Scope. Wiz puts arrayref's reach at "over 35% of all environments" and "used in ¾ of all environments where Rust is present"; figures worth carrying with the caveat that the article does not say what population it measures, so they are best read as its own scanning estate rather than a universal claim. Either way the crate is a near-ubiquitous transitive dependency, which is what makes a ninety-minute window consequential.

Detection concepts, telemetry class first. The distinctive signal is in build-time process telemetry: a compiler or package-manager process spawning a network client, or a toolchain process executing a freshly downloaded binary out of a temporary directory. Neither has a legitimate counterpart in most builds, and both are cheap to alert on in CI. Correlate with persistence-creation telemetry in the minutes after a build; a new registry run key, launch agent or user systemd unit appearing on a build host is close to definitive. In egress telemetry, build agents reaching hosts that are not package registries or artefact stores is the broader pattern worth baselining, since CI runners generally have a small and enumerable set of legitimate destinations.

CrowdStrike 2026 Threat Hunting Report: 88% of public-PoC exploitation landed inside 48 hours, and npm accounted for 87% of software-registry threats

CrowdStrike's Counter Adversary Operations team published its annual Threat Hunting Report on 2026-08-03, drawing on OverWatch managed-hunting and CrowdStrike Intelligence telemetry from what it describes only as "the past year" (CrowdStrike, 2026-08-03); reporting on the release puts that window at the 12 months to 30 June 2026 (SiliconANGLE, 2026-08-03). Only a few of its findings change a defender's decisions; those are the ones worth carrying.

The one that does most work is the exploitation-velocity measurement: "From January through June 2026, 88% of CrowdStrike-observed exploitation of vulnerabilities with a public PoC was conducted within 48 hours of the PoC's release." The named cases go faster still. China-nexus VAULT PANDA and GENESIS PANDA launched deliberate attacks within 24 hours of the public disclosure of a critical web-application flaw, and after the React2Shell disclosure OverWatch worked 800+ hunting leads across more than 80 victims in four days. For a Linux local privilege-escalation flaw disclosed on 29 April with a researcher PoC released the same day, OverWatch saw widespread exploit deployment the following day (roughly 94% of first-day events matching public PoC testing behaviour) and for the Belarus-nexus actor UMBRAL BISON, "They uncovered Belarus-nexus activity in just over 20 hours after public disclosure." CrowdStrike's own read is that this pattern predates frontier AI models but that those models are likely to compress the timeline further by accelerating vulnerability discovery and exploit development.

The practical consequence is a prioritisation input rather than a task: for an internet-reachable component, the arrival of a public proof-of-concept is the trigger, and waiting for a KEV listing or the next scheduled maintenance window puts the decision after the exploitation rather than before it. That reframing bites hardest on the exposure classes this constituency runs at the perimeter, the edge appliances, management planes and web applications that need no user interaction to reach.

On the software supply chain, the concentration figure is the useful one: "87% of identified software registry threats in the first half of 2026 involved npm packages", which CrowdStrike attributes to JavaScript's dependency-chain scale and automatic install scripts. The named activity adds tradecraft detail on a cluster this store already tracks under the name Sapphire Sleet, one of whose recorded aliases is CrowdStrike's STARDUST CHOLLIMA: the DPRK-nexus actor used stolen maintainer credentials in March 2026 to compromise the axios npm package and deliver platform-specific variants of its ZshBucket malware, and in June 2026 injected a malicious npm package as a dependency into at least 131 Mastra AI framework packages, which CrowdStrike reads as trusted AI building blocks becoming supply-chain targets. A separate financially motivated actor, ALTERED SPIDER, compromised more than 300 software dependencies in one day, harvested credentials and pivoted into cloud environments.

Three identity and AI observations complete the picture without carrying separate action, because the underlying tradecraft is already covered in this store's operational entries. Vishing intrusions in H1 2026 doubled against H2 2025, with CrowdStrike recording one case in which an eCrime operator moved from account takeover to SaaS data theft in under five minutes. Monthly device-code phishing attempts rose 15x over six months. And on the defender's side of the ledger, "AI agent-triggered detection leads now surface 2.5x more threat leads than manually driven activity", which CrowdStrike frames as making it harder to separate malicious activity from expected AI-driven behaviour, a triage-volume problem rather than an attacker capability gain. One LLMjacking campaign generated nearly 200,000 API requests in two minutes against a hijacked service.

Builds on: Amazon Threat Intelligence traces three major npm compromises to one DPRK-linked actor, and… · Copy Fail turns an unprivileged Linux shell into root with one portable script; CISA lists it…

Amazon attributes the axios, debug and chalk npm compromises to a DPRK-linked cluster with medium confidence, and names a small 2025 package compromise as the rehearsal

Amazon's threat-intelligence team published an attribution assessment on 2026-07-29 linking three separate npm package compromises to one actor. The load-bearing sentence carries its own hedge, and it should be read with the hedge intact: "based on analysis of command-and-control (C2) indicators and TTPs, Amazon Threat Intelligence assesses with medium confidence that these campaigns are attributable to the DPRK-linked threat actor tracked as SAPPHIRE SLEET, STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, and Alluring Pisces" (AWS Security Blog, 2026-07-29). CyberScoop notes that researchers also track this cluster as UNC1069 (CyberScoop, 2026-07-29). Medium confidence is not attribution-by-consensus. Amazon is also precise about which part is new: it states that "while the axios compromise has been publicly attributed to this DPRK-linked threat actor, the typo-crypto, debug, and chalk incidents haven't previously been connected to it" (AWS Security Blog, 2026-07-29). For a defender the actor label changes little, but the tradecraft description below changes something real.

The compromises run from March 2025 to March 2026 and escalate in blast radius: debug and chalk in September 2025, then axios in March 2026, which Amazon describes as one of the most widely used JavaScript libraries at more than 100 million weekly downloads (AWS Security Blog, 2026-07-29). None of the three involved breaking the registry. In Amazon's words, "in each case with debug, chalk, and axios, the threat actor gained access by socially engineering a trusted maintainer of the package, then published a software update containing malicious code" (AWS Security Blog, 2026-07-29, corrected 2026-08-11), the trust chain held exactly as designed and delivered the malicious version, which is why provenance and signing controls do not help here.

The genuinely new element is the rehearsal. Amazon points at a March 2025 compromise of a package named typo-crypto, into which the actor committed a trojanised file that masqueraded as the unrelated legitimate core-js package, and assesses that "based on the limited number of observed downloads... this campaign was small scale and likely served as a testing ground for the more visible supply chain operations that followed in late 2025 and 2026" (AWS Security Blog, 2026-07-29). That is a patience pattern worth internalising: a package with negligible download counts is not necessarily a failed attack, it may be where the maintainer-social-engineering approach and the payload were refined before being pointed at something with a hundred million weekly installs.

Two mechanics from that rehearsal payload matter for anyone who triages suspicious dependencies. First, detonation was conditional on input rather than on time or environment: the trojanised file executed only when it received a hash input beginning with one specific literal value, and only then downloaded an operating-system-appropriate second stage, with behaviour tailored separately for Windows, macOS and Linux (AWS Security Blog, 2026-07-29). A package like that installs and runs cleanly in any sandbox that does not happen to feed it the trigger value, so "we installed it and nothing happened" is not a clean result. Second, the payload combined file-based persistence with payload rotation and layered obfuscation, base64-encoded text over an XOR cipher under a fixed key (AWS Security Blog, 2026-07-29), so a static scan of the shipped file yields little without unwrapping those layers.

Amazon separately describes a shift in how these operations are structured, observing that attackers increasingly split one malicious workflow across several individually unremarkable packages, and that "this approach is designed to defeat scanners that evaluate packages one by one instead of reasoning about how they interact in a real dependency graph" (AWS Security Blog, 2026-07-29). Amazon frames that as an observation rather than advice, but the implication for a review process is direct: a per-package verdict is the wrong unit of analysis when the malicious behaviour only exists once the pieces are resolved together.

Triage: a benign minified or bundled dependency also carries base64 blobs and unreadable code, so obfuscation alone does not separate the two. The discriminators are behavioural and structural: a code path that stays inert unless a caller supplies a particular argument value, a second-stage fetch whose destination differs by host operating system, and persistence written outside the package's own installation tree. A dependency that reaches the network at all during a build or test run, when its documented function does not require it, is the anomaly worth pulling.