Typosquatted Rust dependency shipped build-time malware in crates
Source headline: Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
Intelligence Summary
A compromised maintainer account published malicious Rust crate releases to crates.io. The releases added a typosquatted dependency that introduced a build script downloading and executing a remote payload during compilation. The affected crate releases are arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9. The Rust Project deleted these malicious versions after the activity was identified. Impact reports mention 245 million downloads for the affected packages. Users should review whether they depend on these crates and update to safe versions.
Recommended Action
Confirm whether the affected technology is in use in your environment before deciding on remediation. Until then, watch authentication and outbound traffic logs for the indicators described in the source. This signal rests on a single report, so corroborate it before acting on anything irreversible.