[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flKewQUYfNDGVlbHb6w2g_300ZKSCfQJfn-KqkExVkqA":3},{"article":4,"iocs":55,"watch_terms":62,"solutions":63,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"2aaaca44-4094-4a94-b008-0ac0040c7725","Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads","rust-supply-chain-attack-puts-build-time-malware-in-crates-with-245-million-down-41850b","The Rust Project has deleted malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account published releases that added a typosquatted dependency whose build script downloaded and executed a remote payload during compilation. The affected releases are arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, all published from the same owner","The Rust Project removed three popular crates from crates.io after a compromised maintainer account published malicious versions. These releases injected a typosquatted dependency, 'proc-macro1', whose build script downloaded and executed a remote payload during compilation. The malicious code was present in the build script, meaning simply building a project that used the affected crates was enough to trigger the payload.","Rust crates arrayref, internment, and append-only-vec had malicious versions published via compromised account.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Frust-supply-chain-attack-puts-build.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgshVe5DUMbByJkLQGRgak37eOf3HddCtrF6KCJfISPdm7l2ZwLFlnjQM3pN2mxPDpc9lWwSoH2fYfucYKBKk3vpuGAKdR5U685IZh8EFbMxWcyVenuRMyqIgvbFUa0_5Sx9pVl9Imu5omju6i7eRE0sKKxiCSKYEV1Say1LLhQHEufY10dgovzX0Nt7as\u002Fs1600\u002Frust.jpg","2026-08-20T20:22:35+00:00","2026-08-20T22:00:15.37262+00:00",9,[17,20,22,24,26,29],{"name":18,"type":19},"arrayref","product",{"name":21,"type":19},"internment",{"name":23,"type":19},"append-only-vec",{"name":25,"type":19},"proc-macro1",{"name":27,"type":28},"Rust","technology",{"name":30,"type":31},"Nextron Systems GmbH","vendor","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,59],{"type":44,"value":57,"context":58},"rust-setup","Payload written to \u002Ftmp\u002Frust-setup on Unix\u002FmacOS",{"type":44,"value":60,"context":61},"PowerShell script","Payload written to %TEMP% on Windows",[30,18,21],{"controls":64,"vendors":149},[65,94,122],{"slug":66,"name":67,"problem":68,"products":69},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":54,"name":95,"problem":96,"products":97},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"slug":123,"name":124,"problem":125,"products":126},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[127,133,141],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":128,"product_name":129,"url":131,"description":132},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":164},"compromised-maintainer-account-delivers-build-time-malware-via-rust-crates","Compromised Maintainer Account Delivers Build-Time Malware via Rust Crates","A compromised Rust maintainer account was used to publish malicious versions of popular crates, affecting packages with a combined 245 million downloads. The attack exploited the trusted position of a legitimate account to inject a typosquatted dependency ('proc-macro1') that executed a remote payload at build time—meaning developers were compromised simply by compiling their project, without ever running the malicious code directly. This highlights the critical risk of transitive, build-time dependencies in modern software supply chains, where implicit trust in package registries can be weaponized. The incident underscores that supply chain attacks do not require a vulnerability in software itself—only access to a trusted publishing identity.",[155,156,157,158,159,160,161,162,163],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management Practices","NIST SSDF (SP 800-218): PW.4 – Reuse Existing, Well-Secured Software","NIST CSF DE.CM-3: Personnel activity is monitored","SLSA Supply Chain Levels for Software Artifacts – Level 2\u002F3 provenance requirements","GDPR Article 32: Security of Processing (where PII may be exfiltrated by payload)","NIST AC-2: Account Management (compromised maintainer account)","NIST SI-7: Software, Firmware, and Information Integrity",{}]