Hackers Poison Arrayref Rust Crate to Push Infostealer Malware

Backdoored Rust packages hit crates.io, exposing developers to malware at build time

Open the article to view the coverage from CSO Online

Hackers poison arrayref Rust crate to push infostealer malware

Hackers compromised the maintainer account behind the widely used Rust crate arrayref to introduce malware that executed on developers' systems during compilation. [...]

Rust Supply Chain Attack Linked to North Korean Hackers

Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server. The post Rust Supply Chain Attack Linked to North Korean Hackers appeared first on SecurityWeek.

Rust Supply-Chain Attack Compromises Popular arrayref Crate

Rust’s security team has disclosed a supply-chain attack involving a malicious arrayref 0.3.10 release and several related crates on crates.io.

Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

The Rust Project has deleted malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account published releases that added a typosquatted dependency whose build script downloaded and executed a remote payload during compilation. The affected releases are arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, all published from the same owner