Malicious Rust crate Arrayref runs a build-time payload (safedep.io)

Article summary

A malicious version of the Rust crate arrayref was released on crates.io, which included a build-time payload that downloaded and ran a remote binary. The malicious code was introduced through a dependency on a typosquatted crate called proc-macro1. The crates.io team has since removed the malicious versions. The incident highlights the risks of supply chain attacks in the Rust ecosystem.

Main themes

• supply chain security
• Rust ecosystem vulnerabilities
• dependency auditing
• build script security
• package management risks
• auditing and testing dependencies

What commenters say

• Restricting build scripts and implementing security controls can help prevent supply chain attacks.
• The Rust community should prioritize auditing and testing of dependencies to ensure security.
• Expecting volunteers to audit dependencies is impractical and unsustainable.
• Using audited package repositories and delaying adoption of new releases can help mitigate supply chain risks.
• The solution to supply chain attacks lies in moving away from author-managed dependencies and towards audited collections of software.
• Crowdsourcing audits and improving tooling can help address supply chain security concerns.
• The lack of security controls in Cargo makes it vulnerable to attacks similar to those seen in the Node.js ecosystem.