GKRootWire
AI Google Adds 'Preferred Source' Button to Help Publishers Fight AI Traffic LossesGadgets Linkdaze Launches a Smart Calendar Aimed at Running Your Whole HouseholdSecurity Popular Rust Crate arrayref Hijacked to Spread Infostealer MalwareCloud & Sysadmin GitHub Details Cause of August 17 Outage, Outlines Reliability FixesDev Tools Show HN: 'Huzzah' Proposes a Fresh Take on AI-Assisted CodingCloud & Sysadmin The Weird Science of Cooling Data Centers With UrineAI Google Adds 'Preferred Source' Button to Help Publishers Fight AI Traffic LossesGadgets Linkdaze Launches a Smart Calendar Aimed at Running Your Whole HouseholdSecurity Popular Rust Crate arrayref Hijacked to Spread Infostealer MalwareCloud & Sysadmin GitHub Details Cause of August 17 Outage, Outlines Reliability FixesDev Tools Show HN: 'Huzzah' Proposes a Fresh Take on AI-Assisted CodingCloud & Sysadmin The Weird Science of Cooling Data Centers With Urine
Security

Popular Rust Crate arrayref Hijacked to Spread Infostealer Malware

Attackers took over a maintainer account to slip malicious code into a widely used Rust dependency, triggering infections at build time.

Security researchers have discovered that arrayref, a small but heavily used Rust crate for slicing arrays into fixed-size references, was compromised by attackers who gained control of the maintainer's package registry account. They pushed a poisoned update containing code that ran during compilation, quietly installing infostealer malware on developers' machines.

Because arrayref is pulled in as a dependency by many other Rust projects, the malicious version could spread far beyond anyone who intentionally chose to use it. Build-time execution is especially dangerous since it runs with a developer's local permissions, potentially exposing credentials, SSH keys, and cloud tokens before anyone notices anything wrong.

The compromised package has since been pulled or patched, but the incident adds to a growing string of supply-chain attacks hitting open-source registries like npm, PyPI, and crates.io.

Why it matters: Build scripts that execute arbitrary code during compilation are a soft spot in nearly every modern package ecosystem, and Rust is no exception despite its reputation for safety. Teams should audit dependency update sources, pin versions, and consider sandboxing builds, since trust in a maintainer's account is often the only thing standing between a routine 'cargo update' and a credential-stealing infection.

Sources: BleepingComputer