Attackers used a compromised Rust crate maintainer account to publish new versions that secretly added a typosquatted dependency. That dependency’s build script downloaded and executed malware during compilation, meaning developers could be infected just by building a project. The attacker also “yanked” safe versions to push developers toward the malicious version as the “fix.”
Attackers gained control of a maintainer account on crates.io and used it to publish malicious releases of three widely used Rust crates: arrayref, internment, and append-only-vec. Each malicious release added just one line to its manifest, a new dependency on a crate called proc-macro1, a typosquat of the extremely common proc-macro2 package. Because the malicious code lived inside that dependency's build script, resolving and building a project that pulled it in was enough to execute the payload. No code from the compromised crates themselves needed to be called.
The attacker also yanked the previously safe versions, 0.3.5 through 0.3.9, under the compromised owner account. This triggered cargo's standard warning telling developers to update to a version that is not yanked. That routine, trusted tooling message became the social engineering lure, nudging developers toward the malicious release as if it were the fix rather than the threat. The attack relied on developers' habit of trusting build tool prompts and quickly resolving dependency warnings without questioning why versions were pulled in the first place.
Teams can reduce exposure to this style of supply chain social engineering by treating urgent "update now" tooling messages with the same scrutiny as a phishing email. Before updating a yanked dependency, verify why it was yanked and by whom. Restrict and monitor network access and process spawning during build steps, since builds should be treated as capable of executing arbitrary code. When a supply chain alert surfaces, check local package caches, such as searching the cargo registry cache for deleted crate files, and pin dependencies to known-good versions while the incident is investigated. Building this kind of verification habit into routine dependency updates is a practical way to blunt attacks that exploit trust in build tooling warnings.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers compromised a maintainer account and published new releases of three popular crates that added a single new dependency, a typosquat crate named proc-macro1 mimicking proc-macro2. That dependency's build script downloaded and ran a malicious payload during compilation, so simply building a project was enough to trigger infection.
The attacker yanked the safe versions (0.3.5 to 0.3.9) under the compromised owner account, which caused cargo to display a warning suggesting developers update to a version that was not yanked. That warning acted as the lure pointing developers toward the malicious release.
Reported IoCs include the IP 23.254.165.112 used as a payload host and command-and-control point, the domain hwsrv-798836.hostwindsdns.com, and dropped files such as /tmp/rust-setup and %TEMP%\rust-setup.ps1.
Treat unexpected yanking of multiple versions and sudden new dependencies as red flags, restrict build-time network access on developer and build machines, and pin known-good versions such as arrayref at 0.3.9 or earlier while checking local caches for deleted crate files.
You run `cargo build` like always… and that alone is enough to drop malware on your laptop. Attackers stole a Rust crate maintainer account and pushed new versions of arrayref, internment, and append-only-vec. One tiny change: a new dependency on `proc-macro1`, a typosquat of `proc-macro2`, whose build script quietly downloaded malware during compile. Here’s the trap: safe versions 0.3.5 to 0.3.9 were all yanked, so Cargo flashes: 'consider updating to a version that is not yanked.' You update, run `cargo build`, and the BitB-style move happens at build time: the injected crate phones home and drops `/tmp/rust-setup` or `%TEMP%\rust-setup.ps1`. Your move: when Cargo nags you about yanked versions, stop and inspect the diff. If a crate update adds a surprise dependency like `proc-macro1`, don’t build it, pin to the last known-good version and get it reviewed.
Researchers found 16 look‑alike (typosquatted) RubyGems packages that trick developers into installing a Windows information stealer. The malicious gems run code automatically during installation, pull down additional malware, and then steal browser logins and crypto wallet data before uploading it…
Attackers impersonated LastPass on GitHub and tricked people searching for the “LastPass Authenticator download” into installing a fake installer. The infection chain used a Microsoft-signed driver to disable many security tools, then deployed an infostealer that stole passwords, crypto wallets,…
Attackers compromised Brevo’s Cloudflare setup using a long-lived API key found in source code, then altered website content at the CDN edge. Visitors were shown fake Cloudflare verification prompts to run Windows commands, and logged-in WordPress admins were targeted with a hidden backdoor plugin…
Researchers found attackers impersonating LastPass with a fake GitHub “LastPass Authenticator” download page that tricks people into downloading a large ZIP and running a fake installer. The installer uses a Microsoft-signed Windows driver to shut down antivirus/EDR tools, then runs a password…
Attackers used fake “LastPass Authenticator” and fake macOS LastPass pages on GitHub to trick people into downloading a malicious installer. The campaign relied on SEO so the fraudulent GitHub page appeared near the top of search results, then redirected victims through multiple pages to a download…
The article highlights real, ongoing campaigns where attackers trick people into installing malware via fake software-download websites and a disguised browser extension. These lures are used to steal credentials, browser cookies, and authenticated sessions, letting attackers take over accounts…
