Hackers poison arrayref Rust crate to push infostealer malware
Malware that ran on developers' systems during compilation was introduced by hackers who gained access to the maintainer account for the popular Rust crate arrayref.
In the same supply-chain attack, the attacker additionally poisoned two further crates, append-only-vec and internment, within a 23-minute span.
With over 53 million downloads in the last 90 days, the arrayref crate is a well-liked Rust library that is utilized by blockchain, graphics, and cryptography tools. The malicious Rust crate releases were arrayref 0.3.10, append-only-vec 0.1.9, and internment 0.8.7, all of which were maintained by the same account, according to a report from application security firm StepSecurity.
While leaving the remaining upstream source code entirely unaltered, the hacker added a depende...