Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
-
The Rust Project removed three popular crates from crates.io after a supply chain attack compromised a maintainer account and injected build-time malware into downstream systems. The malicious releases, which collectively account for roughly 245 million downloads of their legitimate predecessors, were briefly live before being taken down.
The affected versions are arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, all uploaded from the same compromised owner account. Rather than altering the core functionality of these crates, the attacker appended a typosquatted dependency to the manifest. When compiled, that dependency executed a build script designed to download and run a remote payload on the developer's machine.
Because these crates are dependencies in a wide range of Rust projects, the attack has serious implications for the software supply chain. Build-time code execution is particularly dangerous as it grants the attacker access to the developer's environment, including source code, signing keys, and other credentials, before the final binary is even produced.
- Affected crates: arrayref, internment, append-only-vec
- Malicious versions: 0.3.10, 0.8.7, 0.1.9 respectively
- Attack vector: Compromised maintainer account publishing typosquatted dependency with malicious build script
Development teams should immediately audit their lock files for these specific versions, roll back to a previous known-good release if affected, and rotate any credentials that may have been exposed on build machines. It's also worth checking for unexpected dependencies in your
Cargo.lockthat you did not explicitly add.Source: The Hacker News
Given the 245 million downloads across these crates, how is your team verifying the integrity of your Rust dependencies, and do you have a process in place to detect typosquatted packages in your supply chain?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login