append-only-vec

Rust Package Hack Plants Information-Stealing Malware on Developers’ Devices

Rust package maintainer accounts were compromised, resulting in the publication of malicious versions of arrayref and two other packages and the execution of malware during the build process. The malware targeted system data and browser credentials, and developers who used the affected versions during the exposure window are advised to rebuild their environments and rotate secrets.