A compromised maintainer account was used to publish malicious versions of three popular Rust crates—arrayref, internment, and append-only-vec—that injected a typosquatted dependency designed to download and execute arbitrary code during the build process. The Rust Project has since removed these poisoned releases from crates.io, though the affected versions had accumulated over 245 million downloads across their histories. This supply chain attack demonstrates the risk of build-time code execution in dependency management, where malicious payloads can be triggered silently during compilation rather than at runtime.
Read full article at The Hacker News ↗Attackers are increasingly focusing on CI/CD pipelines and developer tools rather than application code itself, exploiting gaps in the software development lifecycle supply chain. Organizations need comprehensive visibility across their entire SDLC and implement rigorous security controls to defend these overlooked but critical infrastructure components.
Researchers discovered 14 malicious npm packages disguised as calendar and streak utilities that deliver RedC2 4.0, an AI-powered Linux backdoor to infected systems. Upon installation, the trojanized packages extract and execute a bundled binary as a background process to establish command and control. This supply chain attack demonstrates how legitimate package repositories remain a vector for distributing sophisticated implants with AI-assisted capabilities.
The bank said there is no evidence that its own systems, networks or data repositories were compromised.
Attackers have compromised popular Rust package repositories by injecting malicious code into legitimate crates, transforming standard build processes into vehicles for distributing infostealer malware. The poisoned packages targeted developer credentials, leveraging the trust developers place in established Rust dependencies to compromise their systems and sensitive authentication data.