Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
By [email protected] (The Hacker News)
AI Summary
A supply chain attack on the Rust ecosystem compromised a maintainer account to publish malicious versions of three widely used crates — arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 — collectively representing 245 million downloads. The malicious releases introduced a typosquatted dependency whose build script downloaded and executed a remote payload at compile time, meaning developers were pwned simply by building their projects. The Rust Project has since deleted the malicious versions from crates.io, but the incident underscores critical risks in build-time dependency execution.
Relevance score: 88.0/100
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →