Hackers Poison Arrayref Rust Crate to Push Infostealer Malware

Backdoored Rust packages hit crates.io, exposing developers to malware at build time

Open the article to view the coverage from CSO Online

Hackers poison arrayref Rust crate to push infostealer malware

Hackers compromised the maintainer account behind the widely used Rust crate arrayref to introduce malware that executed on developers' systems during compilation. [...]

Rust Supply-Chain Attack Compromises Popular arrayref Crate

Rust’s security team has disclosed a supply-chain attack involving a malicious arrayref 0.3.10 release and several related crates on crates.io.

Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

The Rust Project has deleted malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account published releases that added a typosquatted dependency whose build script downloaded and executed a remote payload during compilation. The affected releases are arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, all published from the same owner

Did North Korean hackers launch the supply chain attack on arrayref?

Wiz says the supply chain attack that poisoned arrayref, a Rust package present in roughly three-quarters of environments running Rust, has drawn comparisons with recent North Korean operations.  The harmful update hid a backdoor that steals login information inside a code designed to run automatically when users compile projects. So, anyone who compiled a project on Thursday may now have exposed their computer and secrets. Why is North Korea be…