Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

The Rust Project removed malicious versions of three popular Rust crates from crates.io after a maintainer's account was compromised. The compromised account published new releases of the arrayref, internment, and append-only-vec crates, which included a malicious dependency that downloaded and executed a remote payload during compilation. The affected releases are specific versions of these crates, all of which were published by the same owner. These crates have been downloaded a total of 245 million times. The malicious dependency was added through a typosquatted dependency, allowing it to go unnoticed. The removal of the malicious releases was done to prevent further build-time malware infections.