crates.io is the official package registry for the Rust programming language, hosting open-source crates that developers install via Cargo.
Malicious arrayref 0.3.10 was downloaded 2,285 times from crates.io in the 86 minutes before Rust's security response team deleted it on August 20. Lockfiles still pinned to 0.3.9 kept most builds away from its unsandboxed build-script payload.
Reality
Malicious versions of three Rust crates ran code at compile time on August 20. Wiz says the infrastructure overlaps with DPRK operations, so the campaign should be treated as live.
Perspective Coverage
6 publishersReality
The Rust Security Response Team deleted proc-macro1 and arrayref 0.3.10 on August 20 after a build script fetched and launched a binary. The lure was a yank warning.
Perspective Coverage
7 publishersReality
The Rust Project's crates.io team says attackers posing as recruiters are luring team members and popular crate owners onto video calls that end in a pasted command. In August, one hijacked account shipped malicious crates.
Reality
A developer checked npm, PyPI and crates.io for machine-readable funding data using nothing but their public APIs. npm has a declared field whose value arrives in three shapes, PyPI has hand-typed labels, and the sparse index has neither.
Reality
The experimental Rust crate keeps tenant_id out of the tool schema and compares an authenticated actor's tenant against ownership that the server resolved itself, allowing the call only when the two values match.
Reality
An auditor of abandoned crates.io packages rewrote crc32 from the zlib source, added slicing-by-16 and Python bindings, and shipped the result as crc32-v2. Projects that list crc32 still compile the 2015 code.
Reality
The author of laravel-rest pointed one Eloquent-style client at 62 public APIs across 470 unmocked scenarios and published the wire logs for three of them. Where the rows and the page total live is declared per API.
Reality
A dev.to writeup credits OpenAI's crawler traffic with surfacing a cache-key collision in RubyGems' CDN that served gemspecs under the wrong package names. For npm shops, the lockfile hash covers the tarball; the lookup that chose it is a separate problem.
Reality
Attestation proves a package came out of the pipeline it names. When the pipeline is the thing that was owned, the seal still verifies, and a gate that only checks origin passes all 84 versions pushed on May 11.
Reality
StepSecurity's first annual report logs 56 confirmed supply chain compromises and says plainly that these are its own alerts. The February change is the finding; explaining it is the hard part.
Reality
Wiz says a compile-time payload reached builds through a typosquatted dependency, and the attacker yanked every clean arrayref release so the responsible fix resolved to the poisoned one.
Reality
Wiz says the crates.io compromise executed at build time, so reviewing the library source would have caught nothing. Cargo did the rest.
Reality
Compiling any project that resolved the poisoned crate on August 20 was enough to run a credential stealer. Wiz links the infrastructure to DPRK-attributed campaigns.
Reality
SecretSpec's dotenv-ng 1.0 makes dollar signs literal after dotenvy silently dropped parts of a bcrypt hash. The damage surfaced as an authentication failure, far from the parser that caused it.
Reality