decrypted · 22 august 2026 · supply chain · ai and llm security · surveillance and privacy

The Rust supply chain attack that memory safety didn't stop, and the advisory Microsoft retracted

Crates.io, the official registry for the Rust programming language, spent Thursday hosting a backdoor built on nothing more than a decade of trust in one maintainer's account. Researchers at Wiz have tied the attack to North Korea's Sapphire Sleet group, the same operators linked to this year's poisoning of the Axios and Mastra open source projects, and the lesson lands squarely on UK teams who picked Rust precisely because it was supposed to be the safe choice.

A ten-year-old crate takes its first dependency

On 20 August someone with access to the maintainer account behind arrayref, a small utility crate that converts byte arrays and turns up in roughly three-quarters of all Rust environments, pushed a new version. Two related crates from the same account, internment and append-only-vec, followed twenty minutes later. All three quietly added a single new dependency called proc-macro1, a typosquat of the genuinely popular proc-macro2. According to Wiz, this was the first dependency arrayref had taken on in its entire ten-year history.

That dependency carried a build script, the bit of Rust tooling that runs automatically, with full user privileges, before your code even compiles. It reassembled a command-and-control address from fragments and downloaded a payload that harvested browser credentials, fingerprinted the machine and installed itself to survive a reboot, all before the developer had written a line of their own code that day. Wiz's infrastructure analysis, matching beacon paths and TLS certificates against known Sapphire Sleet campaigns, is the basis for the North Korea attribution. The Rust Security Response Team pulled the packages and locked the account, but Wiz's advice for anyone who built against them in the meantime is blunt: treat the machine as compromised.

Memory safety was never the control that mattered here

The Secure by Design lesson is that Rust's famous safety guarantees, the ones NCSC has spent years encouraging UK organisations to adopt, protect against a completely different class of bug to this one. They stop a programmer writing memory corruption; they do nothing to stop a build script fetching and running arbitrary code the moment cargo build fires. The actual design failure is that most build pipelines still let dependency code execute unsandboxed and with network access, on the assumption that a maintainer account is a proxy for trust. It isn't, and hasn't been for years. Organisations moving codebases to Rust for its safety properties should be pairing that move with sandboxed, network-restricted build environments and pinned dependency versions, not treating the language choice as the whole of the job.

Also this week

Microsoft's Entra ID advisory couldn't decide if it had been attacked. CVE-2026-69836, a maximum-severity flaw in the identity service behind Microsoft 365 and Azure for most of the UK's public and private sector, briefly carried an "exploited in the wild" label before Microsoft told BleepingComputer, in an update posted early on 22 August, that this had been flagged in error. The flaw itself, an unauthenticated remote code execution bug via unsafe deserialisation, was fixed entirely on Microsoft's side, so there's nothing for customers to patch. That's the reassuring part and the uncomfortable part in one: when your identity provider is centralised in someone else's cloud, you get the fix without lifting a finger, and you also get no way of independently checking whether you were exposed while the advisory itself was wrong.

Attackers now ship their own AI agents too. Trend Micro found fourteen npm packages, disguised as calendar and streak-tracking utilities, quietly dropping a cross-platform backdoor called RedC2 4.0. Its Linux component ships with "Red Agent", an LLM layer that turns an operator's plain-English instructions into command sequences for the compromised host. NCSC spent Thursday telling defenders to put guardrails on their agentic AI deployments; the same week, criminal tooling shipped an agent of its own, with none.

The ICO found gaps in how police forces govern facial recognition. An audit of five forces' live and retrospective facial recognition use found inconsistent data protection compliance, with deputy commissioner Emily Keaney noting that "a false match can have serious consequences for people." The recommendations, better senior oversight, fuller logging, and tighter control over where retrospective search images come from, are aimed at every force running the technology, not just the five that were checked.

Sources

If you want to talk through what this means for your own software supply chain, get in touch.

The Rust supply chain attack that memory safety didn't stop, and the advisory Microsoft retracted

A ten-year-old crate takes its first dependency

Memory safety was never the control that mattered here

Also this week

Sources

More like this