Hackers poison popular Rust crates to steal developers' credentials

Hackers slipped malware into several popular Rust packages this week, turning routine software builds into a route onto developers' machines.

The Rust Security Response Team disclosed the supply chain attack on Thursday after receiving a tip about a crate called proc-macro1.

An investigation found that its build script fetched malware from a remote server.

The attack extended beyond a single dodgy crate.

Someone had published a new version of arrayref, a legitimate and widely used Rust package, with proc-macro1 added as a dependency.

The attacker had also yanked recent legitimate releases of arrayref, helping steer users toward the poisoned release.

The Rust team does not believe arrayref's maintainer was responsible.

It suspects the developer's computer or credentials were compromised and locked the account while attempting to contact them.

The attacker also published malicious versions of two other crates maintained by the same developer, internment and append-only-vec.

The poisoned releases weren't around for long.

Arrayref 0.3.10 was available on crates.io for 86 minutes, internment 0.8.7 for 90 minutes, and append-only-vec 0.1.9 for 107 minutes before they were removed.

That's a narrow window, but arrayref is hardly some forgotten package gathering dust in the registry.

Security firm Aikido, which separately analyzed the attack, puts arrayref at roughly 245 million lifetime downloads and append-only-vec at more than 4 million.

However, those figures don't tell us how many developers pulled the malicious versions during the brief period they were live.