Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

Summary

The Rust Project has removed three malicious Rust crates from crates.io due to a supply chain attack. A compromised maintainer account published releases that included a typosquatted dependency, which during compilation, downloaded and executed a remote payload.

IFF Assessment

FOE

This incident represents a supply chain attack that injected malicious code into widely used software components, posing a significant risk to developers and users.

Defender Context

This incident highlights the ongoing threat of supply chain attacks targeting software repositories. Defenders need to be vigilant about the dependencies they incorporate into their projects, paying close attention to unusual changes or newly introduced packages, and consider implementing stricter dependency vetting processes.

Read Full Story →