Rust Supply-Chain Attack Poisons arrayref Release From Crate With 245 Million Lifetime Downloads
Attackers published malicious releases of several Rust crates, including arrayref, after an apparent maintainer compromise.
Why it matters: Package-manager attacks remain one of the highest-leverage paths into developer and build environments.
The Rust Security Response Team confirmed that malicious versions of arrayref, internment and append-only-vec were published after an apparent maintainer account or computer compromise. The poisoned packages depended on a malicious build-time package capable of downloading a payload. Arrayref has roughly 245 million lifetime downloads, though that figure reflects historical package popularity rather than the number of malicious installations. The affected release was available only briefly before removal.