---
title: Suspected North Korean Hackers Targeted Popular Rust Packages in Supply Chain Attack
description: North Korean hackers are considered responsible for exploiting Rust packages, compromising the ecosystem. Swift response prevents further damage.
canonical_url: https://codekeeper.co/ticker/suspected-north-korean-hackers-target-rust-ecosystem
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

# Suspected North Korean Hackers Targeted Popular Rust Packages in Supply Chain Attack

North Korean hackers are considered responsible for exploiting Rust packages, compromising the ecosystem. Swift response prevents further damage.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Aug 24, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsuspected-north-korean-hackers-target-rust-ecosystem%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsuspected-north-korean-hackers-target-rust-ecosystem%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsuspected-north-korean-hackers-target-rust-ecosystem%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsuspected-north-korean-hackers-target-rust-ecosystem%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsuspected-north-korean-hackers-target-rust-ecosystem%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsuspected-north-korean-hackers-target-rust-ecosystem%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

North Korean hacking group Sapphire Sleet is the likely suspect behind a Rust ecosystem supply chain attack on August 20, which compromised arrayref — a package with over 245 million downloads found in roughly 75% of Rust environments. The attackers pushed a malicious version from the legitimate maintainer's account, then quickly poisoned two more related crates. Hidden inside was a build script designed to fetch a second-stage payload over TLS with certificate validation disabled. The Rust Security Response Team yanked the malicious packages within 86 minutes. No evidence of actual exploitation was found. Wiz tied the attack to Sapphire Sleet based on infrastructure overlaps with earlier NPM attacks targeting Axios and Mastra. Source: [SecurityWeek](https://www.securityweek.com/rust-supply-chain-attack-linked-to-north-korean-hackers/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsuspected-north-korean-hackers-target-rust-ecosystem%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsuspected-north-korean-hackers-target-rust-ecosystem%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsuspected-north-korean-hackers-target-rust-ecosystem%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsuspected-north-korean-hackers-target-rust-ecosystem%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsuspected-north-korean-hackers-target-rust-ecosystem%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsuspected-north-korean-hackers-target-rust-ecosystem%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Hackers Clone Trusted Websites to Chain Chrome and Windows Zero-Days in Espionage Campaign Sep 23, 2026](https://codekeeper.co/ticker/china-hackers-exploit-chrome-windows-target-governments)

[Teens Behind 2024 TfL Cyber-Attack Were Already on Police Radar Aug 12, 2026](https://codekeeper.co/ticker/tfl-cyber-attack-repeat-offenders)

[CISA Warns of Actively Exploited Magento Plugin Flaw Enabling Remote Code Execution Aug 12, 2026](https://codekeeper.co/ticker/cisa-warns-patch-mirasvit-vulnerability-magento)

[Data Breach Hits 3 Million Texas Hunting and Fishing License Holders Aug 12, 2026](https://codekeeper.co/ticker/texas-credit-monitoring-after-data-breach)