The OpenSourceMalware Show #18

What it is

Episode 18 of the OpenSourceMalware Show (recorded Thursday, August 20th, hosts Jenn Gile and Paul McCarty). The value beyond the summary is in how these attacks evade scanning and why cleanup keeps failing — details the summary's package lists don't carry.

How it works

The arrayref compromise used an account-takeover playbook the hosts say has recurred all year: the attacker (via compromised maintainer account "D Roundy") did not inject malware into the existing legitimate packages. Instead they published six net-new malicious packages and wired them in as dependencies of the trusted crates (arrayref, internment, append-only-vec). One added a typosquatted build dependency that downloaded and executed a remote binary at compile time. Consequence: scanning the top-level package shows nothing; the malware only appears if you resolve and inspect the dependency tree.

PolinRider's reinfection loop is explained mechanically: the malware persists on the developer's machine, not just in the repo, and can commit to Git history without an obvious trail — so wiping the repo leaves the infection intact and re-seeds it.

Preconditions / Affected

• Rust environments pulling arrayref (or its build-dep chain); arrayref sits in roughly three quarters of Rust environments.
• Organizations running both Ruby and Node stacks — the StubMaker/npm cluster gives one actor two independent entry paths; PowerShell was also reportedly hit.
• PolinRider: any developer machine previously touched, regardless of repo cleanup.

What to do

• Scan transitive/build dependencies, not just top-level manifests — this attack class is invisible to top-level-only scanning.
• Use the Rust-published check script (referenced but not linked in the text) to determine if you pulled any affected packages; IoCs were posted to their LinkedIn.
• Treat a compiled binary shipped inside an npm/RubyGems package as a high-confidence red flag — the hosts call it "one of the biggest red flags an analyst can ask for," now appearing more often as less-experienced actors (possibly AI-assisted) ship C++/Rust/Go binaries.
• For PolinRider: clean the developer host, not only the repository, and audit Git history for silent commits.

Caveats

• Initial arrayref reporting undercounted the malicious packages (started at ~two, later found to be more) — early IoC lists may be incomplete.
• DPRK attribution and cross-ecosystem payload identity come from Wiz Research (shared C2 pattern, overlapping IPs, matching SHA-256); the hosts relay rather than independently derive it. The PowerShell involvement is stated only as "evidence," not confirmed.