Backdoored Rust packages hit crates.io, exposing developers to malware at build time | #cybercrime | #infosec

The malicious code ran at build time The attack did not require developers to execute suspicious code or even call a function from arrayref. “Because Rust build scripts run at compile time, simply building any project whose lockfile resolved arrayref 0.3.10 was enough to detonate the payload. The crate’s code never needs to be called,” […] Thank you for subscribing to our RSS feed! The post…