Malicious Rust crate Arrayref runs a build-time payload

	Malicious Rust crate Arrayref runs a build-time payload(safedep.io)
	542 points by abhisek 1 day ago \| 490 comments
	tl;dr: A compromised release of the popular Rust crate `arrayref` (v0.3.10) added a dependency on a typosquatted crate `proc-macro1` (impersonating David Tolnay), whose build script downloads and executes a remote binary from 23.254.165.112 at compile time on Linux, macOS, and Windows. The attacker yanked prior clean versions to funnel users to the malicious release, and since `arrayref` is a transitive dependency of `winit`, `tiny-skia`, and common GUI stacks, exposure is broad. crates.io has removed the malicious versions, and the maintainer's GitHub account is gone.
	HN Discussion: ↑crates.io and GitHub are unprepared and lack transparency during security incidents ↑Languages should have larger stdlibs to reduce dependency sprawl and micro-crates ↑Cargo needs sandboxing for build.rs scripts to limit blast radius ↑Rust's dependency culture mirrors npm's flaws, making attacks inevitable ↑Effect-based languages or containerization are needed to constrain untrusted code