Summary: The maintainer account for the popular Rust crate arrayref was compromised, leading to the publication of trojanized versions designed to infect developer machines with infostealer malware during the build process.

Body:

The XploitLK community is tracking a significant supply chain incident affecting the Rust ecosystem. The maintainer account for the widely used arrayref crate was compromised, allowing attackers to publish malicious versions of the package. These poisoned releases were engineered to execute payloads on developers' systems automatically during the compilation phase.

While the exact scope of the compromise is still being assessed, the attack vector highlights the ongoing risks associated with open-source dependency management. The malicious code was designed to deploy an infostealer, a type of malware that exfiltrates sensitive data such as credentials, environment variables, and developer secrets from infected workstations.

According to the original report, the malicious versions have been removed from the official crates.io registry. However, developers who have already used the affected versions in their projects should immediately rotate any credentials or tokens that may have been exposed on their build machines and audit their dependency lock files for the vulnerable version numbers.

The incident serves as a critical reminder for the community to verify package integrity, monitor for unexpected version updates, and consider using checksum verification and sandboxed build environments to mitigate such risks.

For full technical details and the list of affected versions, refer to the original article from BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-poison-arrayref-rust-crate-to-push-infostealer-malware