TLDR Tech / InfoSec
Supply Chain Attack on arrayref
The Rust Security Response Team confirmed that the popular arrayref crate was maliciously republished after being made to depend on proc-macro1, a crate that included a build script downloading a malicious payload. Related crates internment and append-only-vec from the same author were also compromised, likely via stolen credentials rather than intentional action. The malicious versions remained live for 86 to 107 minutes before removal. The team has deleted proc-macro1 and its sibling packages and unyanked the legitimate arrayref versions. Developers should run the provided find command against ~/.cargo/registry/cache to check for arrayref@0.3.10, internment@0.8.7, append-only-vec@0.1.9, or any version of the deleted proc-macro1 family.
Read the full story