The affected versions are arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, all uploaded from the same compromised owner account. Rather than altering the core functionality of these crates, the attacker appended a typosquatted dependency to the manifest. When compiled, that dependency executed a build script designed to download and run a remote payload on the developer's machine.

Because these crates are dependencies in a wide range of Rust projects, the attack has serious implications for the software supply chain. Build-time code execution is particularly dangerous as it grants the attacker access to the developer's environment, including source code, signing keys, and other credentials, before the final binary is even produced.

• Affected crates: arrayref, internment, append-only-vec
• Malicious versions: 0.3.10, 0.8.7, 0.1.9 respectively
• Attack vector: Compromised maintainer account publishing typosquatted dependency with malicious build script

Development teams should immediately audit their lock files for these specific versions, roll back to a previous known-good release if affected, and rotate any credentials that may have been exposed on build machines. It's also worth checking for unexpected dependencies in your Cargo.lock that you did not explicitly add.

Source: The Hacker News

Given the 245 million downloads across these crates, how is your team verifying the integrity of your Rust dependencies, and do you have a process in place to detect typosquatted packages in your supply chain?