流行Rust包arrayref的0.3.10版本于2026年8月20日遭到破坏1。该版本新增了对typosquatted包proc-macro1的依赖1，其构建脚本能在项目编译时下载并执行远程二进制文件1。攻击者通过下架旧版本（0.3.5-0.3.9）将开发者推向恶意的0.3.10版本1。arrayref维护者账号droundy遭入侵1，另有冒充David Tolnay身份的账号dtolney参与其中1。
恶意二进制文件由位于23.254.165.112:9089和23.254.165.112:443的服务器提供1。在Unix系统上，有效载荷被写入/tmp/rust-setup目录1，而Windows系统则通过PowerShell脚本执行1。该恶意代码支持x86_64、aarch64、i686和armv7四个处理器架构1。考虑到arrayref已被下载约2.45亿次1，此次供应链攻击的潜在影响范围广泛。crates.io团队已移除这些恶意版本1。
A compromised version of the widely-used Rust package arrayref has been weaponized to execute malicious code during project compilation.1 On August 20, 2026, version 0.3.10 of arrayref was poisoned with a dependency on a typosquatted package called proc-macro1, whose build script downloads and runs a remote binary file when projects are compiled.1 The attackers, operating under the compromised arrayref maintainer account droundy and a spoofed account impersonating David Tolnay (dtolney), forced developers toward the malicious release by delisting earlier versions 0.3.5 through 0.3.9.1
The attack infrastructure consisted of two malicious servers at IP address 23.254.165.112 using ports 9089 and 443.1 The compromised code supports four processor architectures—x86_64, aarch64, i686, and armv7—and deploys different execution methods depending on the operating system: on Unix systems, the payload writes to /tmp/rust-setup, while on Windows it runs through PowerShell scripts.1 Arrayref has accumulated approximately 244,989,384 total downloads, making it a high-impact supply chain target.1 The crates.io team has since removed the malicious versions from the repository.1
评论
还没有评论，欢迎留下第一条。