Malicious Rust crate "arrayref" executed malware at build time

A malicious package named "arrayref" was discovered in the Rust crate registry, executing a harmful payload at build time using a procedural macro mechanism. The attack targeted developers' machines without their knowledge during the compilation stage. This represents a supply-chain attack on open-source software infrastructure.

Similar stories

💻 Technology npm worm "Shai-Hulud" infected packages with 2 billion monthly installs using legitimate signatures VentureBeat · 15d ago 💻 Technology AST-grep rewrites Tree-sitter in Rust, achieving 30% speed boost Hacker News · 25d ago 💻 Technology LiteLLM supply-chain attack exposes credentials from Cisco, Samsung, AWS and 2,500+ others TechRadar · 2h ago