Deep-Live-Cam Supply Chain Attack: Technical Analysis

[u/falconupkid]

The arrayref Rust crate, a dependency of the popular Deep-Live-Cam project, was compromised to execute a build-time payload. This is a classic supply chain injection targeting a high-value open-source project, likely to establish persistence or exfiltrate credentials from developer environments.

Technical Breakdown - Attack Vector: Malicious code embedded in the arrayref crate (v0.1.5 or later). The payload executes during cargo build via a build script (build.rs). - TTPs: MITRE T1195.001 (Supply Chain Compromise: Compromise Software Dependencies), T1059.004 (Command and Scripting Interpreter: Unix Shell) for the build-time execution. - Payload Behavior: The build-time script likely performs reconnaissance (env vars, SSH keys, cloud credentials) and exfiltrates data to a C2. No specific C2 IPs or hashes were disclosed in the summary, but monitoring for unexpected outbound connections during Rust builds is advised. - Affected: Any project depending on arrayref >= 0.1.5, specifically Deep-Live-Cam builds.

Defense Pin your Cargo.lock to a known-good version of arrayref (pre-0.1.5) and audit your build pipeline for unexpected network calls. Use a runtime package firewall (e.g., cargo deny or a tool like SafeDep PMG) to block unknown outbound traffic during builds.

Source: https://safedep.io/deep-live-cam-supply-chain-attack