+− THE DAILY DIFFdev & AI news
Amavidiyo / postmortem
NEEDS REVIEW

I-Rust crate yasebenzisa i-malware ngesikhathi sokuhlanganisa. Imizuzu engu-86.

Ishicilelwe Sep 15, 2026 · 3:09 · Niko from Axrisi

I-Rust crate enama-macro amane anokulandwa okungu-260 million yengeza ukuncika okukodwa, futhi i-"cargo build" isebenzisa i-binary yomuntu ongaziwa emshinini wakho.

I-Rust crate enama-macro amane anokulandwa okungu-260 million yengeza ukuncika okukodwa, futhi i-"cargo build" isebenzisa i-binary yomuntu ongaziwa emshinini wakho. Agasti 20, 2026: i-arrayref 0.3.10 ifika ku-crates.io incike ku-proc-macro1 — hhayi i-proc-macro2, eyangempela — isikripthi sayo sokwakha silanda umthwalo, siwufake ku-/tmp/rust-setup bese siwuvusa ngokuhlukene ngenkathi iphrojekthi yakho ihlanganiswa. Izinguqulo ezihlanzekile ziyasuswa ngakho-ke isixwayiso se-Cargo sikuhambisa kuleyo enobuthi. Imizuzu engu-86 kamuva iyasuswa.

Funda uhlelo olubhaliwe (isiNgisi) ↗

Lokho okuhlanganiswa yile vidiyo

  • i-cargo build isebenzisa i-binary yomuntu ongaziwa
  • Amalungu: Rust Blog, SafeDep, Hacker News
  • Lena yi-The Daily Diff, i-postmortem
  • Umgomo wesikhathi: 02:11 ukuhlola → 07:15 kushicilelwe → 08:41 kususwe
  • Indlela: build.rs, akukho sandbox, i-yank lure

Umbhalo obhaliwe ohunyushwe

Kuhunyushwe kusuka ekulandiseni kokuqala kwesiNgisi. Umsindo namazwibela atholakalayo alawulwa yi-YouTube.

i-cargo build isebenzisa i-binary yomuntu ongaziwa

0:00 I-Rust crate enama-macro amane enokulandwa okungamakhulu amabili namashumi ayisithupha ezigidi yengeza okukodwa ukuncika, futhi i-cargo build isebenzisa i-binary yomuntu ongaziwa emshinini wakho. Agasti 20, 2026. i-arrayref 0.3.10 ifika ku-crates.io incike ku-proc-macro1. Hhayi i-proc-macro2, eyangempela: idijithi eyodwa iphume, futhi isikripthi sayo sokwakha sisebenzisa i-payload ngenani iphrojekthi yakho ihlanganiswa. Ithimba lezokuphepha le-Rust liyayisusa emizuzwini engu-86 kamuva.

Amalungu: Rust Blog, SafeDep, Hacker News

0:22 I-SafeDep ishicilela ukususa. Hacker News: amaphuzu angu-554. Kwenzeka kanjani, kungani i-Cargo ikuvumela, futhi ubani ozothola icala. Lena yi-The Daily Diff, i-postmortem. Ngo-02:00 ekuseni, UTC.

Lena yi-The Daily Diff, i-postmortem

0:33 I-akhawunti ebizwa nge-d-tolney, igama elilodwa ku-David Tolnay, onakekela ingxenye ye-Rust, ishicilela i-proc-macro1 1.0.106: i-proc-macro2 yangempela,

Umgomo wesikhathi: 02:11 ukuhlola → 07:15 kushicilelwe → 08:41 kususwe

0:41 iqanjwe kabusha. Ukuhlola. 07:11. Inguqulo 1.0.107 yengeza isikripthi sokwakha, kanye i-base64, i-TLS kanye neklayenti le-HTTP. Nge-token parser. 07:15. I-akhawunti yomlungisi ishicilela kabusha i-arrayref njengo-0.3.10 futhi isusa zonke izinhlobo ezindala. I-Cargo iphrinta: cabanga ukubuyekeza inguqulo engasuswanga. Okuwukuphela kosala yile enobuthi.

1:02 Isixwayiso yilo olukhohlisayo. Ngeminithi efanayo, inkampani yezokuphepha iyayibika ku-Rust. 07:54, inkinga ye-RustSec. 08:29, inkinga ku-repo; umhlaseli uphendula ngo-0.3.11 kanye nokuncika okubi kwesibili. 08:41, kususwe. Imizuzu engamashumi ayisishiyagalombili nesithupha. Kungani? Okukodwa: I-Cargo yakha konke ukuncika okumenyezelwe, kubiziwe noma cha. Umugqa owodwa wombhalo wanele.

1:21 Okwesibili: isikripthi sokwakha sisebenza emshinini wakho, njengawe, ngezinkinobho zakho ze-SSH kanye ne-cargo

Indlela: build.rs, akukho sandbox, i-yank lure

1:26 i-token, ngaphambi kokuba ikhodi yakho ihlanganiswe. Akukho sandbox, ngokuhlela: yile ndlela ama-crate athola ngayo imitapo yolwazi ye-C. Okwesithathu: ngaphakathi kukhona i-proc-macro2 yangempela, ngakho ukwakha kuphumelela. I-payload: iklayenti le-TLS elithemba noma isiphi isitifiketi lithola i-binary, liyifaka ku-/tmp/rust-setup bese liyivusa ngokuhlukene. Ku-Windows idlula nge-wscript ukuze ibaleke i-Cargo's job object; umthombo umbono uthi kunjalo. Isigaba sesibili, ngokwe-RustSec thread: ithuluzi lokufinyelela kude eliqondise ku-

1:52 iziphequluli nama-crypto wallets. Kubuhle, njengoba abasebenzisi abakhulu be-arrayref bebandakanya i-secp256k1 ne-Solana. git blame. Imodeli ye-Cargo, amaphesenti angamashumi amahlanu nanhlanu: ukuncika kusebenzisa ikhodi kumshini wakho ngesikhathi sokuhlanganisa, akukho sandbox, futhi isixwayiso sokususa sahambisa abantu ku-

git blame — ukuhlukana

2:07 ubuthi. I-akhawunti eyodwa, amashumi amathathu: igama lokungena elilodwa ishicilela kabusha i-crate enengxenye eyodwa kwezine ukwethemba okuyizigidi. Idijithi eyodwa, amashumi nanhlanu: ukushaya okukodwa kokhiye ku-crate ethenjwe kakhulu ye-Rust, futhi akekho ofunda isihlahla. Umsakazo wokuqhuma: 2,285 ukulandwa emizuzwini engu-86. Ngaphandle kwamaphesenti ayishumi omgwaqo, ngoba iningi lama-lockfile lalibambe u-0.3.9. i-crates.io ithi akukho ubufakazi bokusebenzisa.

Umsakazo wokuqhuma: 2,285 ukulandwa

2:27 Abantu ababili ku-RustSec thread abavumelani; omunye uthola isevisi ye-systemd. Ku-Hacker News i-thread ephezulu ayikhulumi nge-malware. Yikhasi le-crate, lapho u-0.3.10 manje akazange abe khona. Isinqumo, i-postmortem: NEEDS REVIEW. Imizuzu engamashumi ayisishiyagalombili nesithupha yokususa, okuthunyelwe kubhulogi ngosuku olufanayo, i-akhawunti ikhiyiwe: leyo ingxenye i-SHIP IT. Kodwa ikhasi le-crate likhombisa ukuthi akukho okwenzekile, i-cargo audit ithula kukhophi egcinwe ku-cache

Isinqumo + umugqa wangoMsombuluko

2:48 futhi izikripthi zokwakha zisasebenza njengawe. UMsombuluko: sebenzisa umyalo wokuthola we-Rust blog, futhi uphathe isixwayiso sokususa njengombuzo, hhayi umyalo. Ngithumele isigameko ongakavunyelwa ukukhuluma ngaso, emazwaneni, noma ku-the daily diff dot dev. Futhi yilokho umehluko namuhla. Ngingu-Niko wase-Axrisi. Hlanganisa ngokuzibophezela.

Imithombo

  1. Rust Blog, "Supply chain attack on arrayref" (security-response, Aug 20, 2026)blog.rust-lang.org
  2. RUSTSEC-2026-0260 (arrayref)github.com
  3. RustSec issue #3161 (the original report, IOCs, victims)github.com
  4. SafeDep technical analysissafedep.io
  5. GitHub issue on the repo (0.3.11 spotted)github.com
  6. crates.iocrates.io
  7. Hacker News (554 points)news.ycombinator.com
  8. BleepingComputerwww.bleepingcomputer.com

Amavidiyo ahlobene