Updated 33min ago
Package Repository P…Dependency Confusion…Build Pipeline Compr…+2
Malicious `arrayref` Release Pulled Rust Build-Time Payload via Typosquatted `proc-macro1`
A supply-chain attack hit the Rust ecosystem after arrayref 0.3.10 was published with a dependency on proc-macro1 1.0.107, a typosquatted package impersonating proc-macro2. The malicious crate used a build.rs script to download and execute a second-stage payload during compilation, meaning developers and CI systems could be compromised simply by building an affected project. Rust maintainers said they received a report at 07:15 UTC and removed the malicious packages, including related crates such as proc-macro-en, aovine, arone, aronenao, and tinymember, while also restoring or yanking affected versions of arrayref, internment, and append-only-vec.
Timeline
- 23h agoWiz publishes second-stage malware analysis and IOCs
- 23h agoWiz reports infrastructure overlap with recent DPRK-linked campaigns
Malware Intelligence·16sources·Updated 33min ago
