Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
Summary
The Rust Project has removed three malicious Rust crates from crates.io due to a supply chain attack. A compromised maintainer account published releases that included a typosquatted dependency, which during compilation, downloaded and executed a remote payload.
IFF Assessment
This incident represents a supply chain attack that injected malicious code into widely used software components, posing a significant risk to developers and users.
Defender Context
This incident highlights the ongoing threat of supply chain attacks targeting software repositories. Defenders need to be vigilant about the dependencies they incorporate into their projects, paying close attention to unusual changes or newly introduced packages, and consider implementing stricter dependency vetting processes.