Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

wiz.io | incident | #supply-chain | #malware | #rust | #backdoor | #dprk | #wiz | #crates-io

Summary

Malicious arrayref, internment and append-only-vec crates appeared on crates.io: a typosquatted proc-macro1 build script fetched and ran a backdoor at compile time, overlapping recent DPRK campaigns.
Published
Collected

original ↗

Related coverage

  1. Two popular Rust crates arrayref and append-only-vec compromised in Supply Chain Attack (aikido.dev)
  2. Backdoor in XZ Utils allows RCE: everything you need to know (wiz.io)
  3. Extend Wiz to your Developers: Enable secure cloud development with agility (wiz.io)
  4. Ensuring Supply Chain Security: Verify container image integrity with the Wiz Admission Controller (wiz.io)
  5. Compromised Flutter package on pub.dev contains XCSSET malware (aikido.dev)
  6. Shai-Hulud Rises From the Dead after 111 days (aikido.dev)

back