Hackers Target Popular arrayref Rust Crate in Supply-Chain Attack

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

Security researchers are sorting through a complex, stealthy, and fast-moving supply-chain attack aimed at pushing information-stealing malware by compromising the account of the maintainer of multiple Rust crates and introducing four more attacker-owned crates. In addition, researchers with Wiz wrote that there also appears to be overlap with supply chain campaigns run by nation-state actors linked to the government of North Korea. According to multiple reports, unknown threat actors this week compromised the maintainer account behind arrayref, a widely used package with more than 245 million downloads that Sai Likhith, backend engineer with StepSecurity, described as a “tiny array-conversion utility” that is “one of the Rust ecosystem’s quiet load-bearing crates.” Over the next 23 minutes, as part of the same attack, the hackers poisoned two other crates from the same owner, append-only-vec and internment. In addition, the attackers published versions of four other crates – aovine, arone, aronenao, and tinymember – which have been removed from crates.io. Also, the releases published by the attacker – arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 – from the same compromised owner account, were removed. All were published with the same typosquatted dependency (proc-macro1), which came with a build script that downloaded and executed a remote payload. Avoiding Detection “Because build scripts run during compilation, building an affected project was sufficient to execute the payload,” Wiz researchers Rami McCarthy and Benjamin Read wrote in their report. …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://devops.com/hackers-target-popular-arrayref-rust-crate-in-supply-chain-attack/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.