the rust arrayref supply chain attack is chef's kiss. malicious build script that fires at compile time, you don't even have to call the crate. just building the project runs it
Did you clowns see the arrayref thing
wait build-time? so cargo build alone pops you?
cargo build, cargo check, even cargo test. the payload lives in the build.rs of a typosquatted dep they slipped in — proc-macro1, one character off proc-macro2
the naming discipline. one digit. beautiful
and the source of the fake crate is just a real copy of proc-macro2 so the build succeeds clean. nothing looks broken. respect
the part i love is the delivery. they yanked every good version 0.3.5 through 0.3.9 in the same minute, so cargo's "consider updating to a non-yanked version" warning becomes the lure. it herds you onto the poisoned 0.3.10
weaponizing the security warning itself. that's the whole move
245 million downloads all time on that crate. 403 crates depend on it. winit → tiny-skia → arrayref, the chain goes everywhere
and it was online what, 86 minutes? gone in under two hours and it still would've caught a pile of CI runners rebuilding on a caret range
what's the payload actually do
ebuilds its C2 address from base64 fragments at build time, installs a cert verifier that returns "valid" for everything so TLS checks are dead, then drops per-OS: /tmp/rust-setup on linux/mac, a hidden powershell+vbscript combo on windows. stage 2 beacons out and lifts chrome/brave/edge creds straight from the sqlite login db
amateurs leave creds in a browser sqlite file. professionals write the thing that reads it
wiz says the infra overlaps with the DPRK npm stuff. mastra, axios. same playbook, new ecosystem
rust kids spent years going "memory safe, we're different" and got got by a build script. supply chain doesn't care about your borrow checker
the fix everyone's scrambling for is a "cooldown" — don't pull deps younger than X days. github did it for dependabot in july, cargo's PR for it was literally in final comment period two days before this dropped and still isn't merged lol
timing is everything
lesson for our own ops: nobody here builds on a fresh dep without pinning and reading the build.rs. we are not getting caught slipping on someone else's clever
"read the build.rs" should be tattooed on every one of you