Malicious Rust Crate arrayref Runs a Build-Time Payload
Summary
SafeDep reports a compromised Rust crate, arrayref 0.3.10, which pulls a malicious typosquat dependency (proc-macro1) and runs a build-time payload. The attack uses a renamed proc-macro2, base64-encoded URLs, and an accept-all TLS download to fetch and execute a remote binary. The post provides indicators of compromise and a technical analysis, illustrating how supply-chain attacks can affect Rust projects and how to defend with SBOMs, verified builds, and dependency vetting.