North Korean group poisoned Rust's most-used crate after hijacking a maintainer's account
A supply-chain attack on the Rust ecosystem hit arrayref, an array-conversion crate with over 245 million downloads present in roughly 75% of Rust environments. The threat actor — likely Sapphire Sleet, the same North Korean group behind the Axios and Mastra npm attacks — published a poisoned version (0.3.10) from the maintainer's own compromised account, hiding a second-stage binary fetch inside build.rs. Rust's security team yanked the packages within ~86 minutes and found no evidence any victim ran the malicious build. This is one more sign that standard crates can't be trusted on trust alone anymore.