3 casos · pág. 1/1
Rust 1.100, scheduled for November 12, 2026, will stabilize Cargo dependency cooldowns. Developers can reject newly published crate versions until they reach a configurable minimum age. The aim is to give researchers, maintainers and registries time to detect malicious releases before automated updates spread them across development envir…
On August 20, 2026, a compromised release of the Rust crate arrayref (0.3.10, about 245 million all-time downloads) appeared on crates.io. It added a dependency on the typosquatted crate proc-macro1 1.0.107, whose build script downloads and runs a remote binary at compile time. The maintainer account droundy appears to have been compromis…
On September 8, 2026, an attacker added a malicious source dependency to Deep-Live-Cam, a Python face-swapping app with about 96,600 GitHub stars. Commit 7895c547 ("chore: update requirements.txt") rewrote 18 dependency entries and added requests @ git+https://github.com/pypls/requests.git. This points installation to a lookalike reposito…
