Rust Supply Chain Attack Exposes Solana Ecosystem

A supply chain attack on August 20, 2026, exposed the Solana ecosystem to potential remote code execution and credential theft. The attack lasted less than two hours and affected three widely used Rust packages: [email protected], [email protected], and [email protected].

The malicious versions of these crates were published to the crates.io registry in a 23-minute window between 07:15 and 07:38 UTC. They contained a dependency on a poisoned version of proc-macro1, which activated a build script during Cargo builds that downloaded and executed malware on developer machines.

The Rust Security Response Team quickly identified the threat and removed all three compromised crates from the registry within two hours. The maintainer account believed to be compromised was locked.

Researchers at Wiz linked the attack to North Korean cyber actors, specifically a group tracked as Sapphire Sleet. This attribution fits a well-documented pattern of state-sponsored groups targeting cryptocurrency infrastructure through supply chain compromises and social engineering.