MalwareBleeping Computer
9.5 — CRITICAL
Hackers poison arrayref Rust crate to push infostealer malware
Hackers compromised the maintainer account behind the widely used Rust crate arrayref to introduce malware that executed on developers' systems during compilation. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
Hackers compromised the maintainer account behind the widely used Rust crate arrayref, introducing malware that executed on developers' systems during compilation, affecting multiple projects and platforms.
⚙️Technical Details
Affected Systems
Unix systemsWindows
Attack Vectors
/tmp/rust-setup%TEMP%\rust-setup.ps1hidden wscript.exe and VBS launcher
💥Impact Assessment
Severity: critical
Who Is at Risk
Developers who installed arrayref, append-only-vec, or internment during the exposure window of nearly 1.5 hours
🛡️Recommended Actions
1Search Cargo.lock files for dropped files
2Review traffic to 23.254.165[.]112 on ports 9089 and 443
3Rotate all accessible credentials, CI tokens, signing keys, and other secrets
📦Affected Products
Arrayref: TrueAppend-Only-Vec: TrueInternment: True
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.