North Korean hackers suspected of poisoning the Rust arrayref supply chain, affecting Solana and Ethereum tools
On August 20, attackers released malicious versions of the Rust packages arrayref, internment, and append-only-vec. arrayref is present in approximately three-quarters of Rust development environments and is widely used in Solana and Ethereum tooling. The malicious versions were removed within 86 minutes of their release, and the Rust security response team said the maintainers themselves may have been victims. Attack Mechanism: A Typosquatted proc-macro1 Dependency, Hidden Build Script, and Two
Bisc·08-21 03:30



