Malicious arrayref, internment and append-only-vec versions hit crates.io
Malicious builds of arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 were published to crates.io early on August 20 UTC, each depending on proc-macro1 — a typosquat of proc-macro2 whose build script downloaded and ran a payload at compile time. The windows were short (86, 90 and 107 minutes before deletion), but any machine that built during them executed attacker code, and the Rust Security Response Team published a find command to scan ~/.cargo/registry/cache for the affected crate files.
Source: blog.rust-lang.org ↗
the crate had a build script that was downloading a malicious payload
Rust Security Response Team
Why this matters
- → Malicious build scripts executed on developer machines during compilation
- → Supply-chain typosquat leveraged legitimacy of popular crates (arrayref, internment)
- → Narrow exposure window (86–107 min) limited but did not prevent real damage
Rust supply-chain attack