Compromised Maintainer Poisons Three Rust Crates With Build-Time Malware
Compromised maintainer credentials put build-time malware into three popular Rust crates: arrayref, internment, and append-only-vec. Each poisoned release added a dependency on proc-macro1, a typosquat of proc-macro2 whose build script downloaded and executed a remote payload, meaning merely resolving the crate ran the code. The Rust Security Response Team deleted the releases within 86 to 107 minutes, unyanked the legitimate old versions, and locked the account. Developers should scan ~/.cargo/registry/cache for the tainted files.