Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

The Rust Project has deleted malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account published releases that added a typosquatted dependency whose build script downloaded and executed a remote payload during compilation. The affected releases are ava

Bottom Line: A compromised Rust crate maintainer published malicious releases on crates.io, affecting 245 million downloads.

What's Happening: The Rust Project deleted three widely used crates from crates.io, including 'serde_json', 'serde', and 'serde_yaml', after a maintainer compromised their account. The malicious releases added a typosquatted dependency, 'rusty-gnupg', that executed a remote payload during compilation. The compromised releases were published on February 7, 2023.

What to Do: Security teams should review their dependencies on crates.io and verify the integrity of their Rust projects. They should also consider using alternative package managers, such as Cargo, to minimize the risk of supply chain attacks.