Resultados

2 casos · pág. 1/1

gbhackers.com · há 12h medium

Rust 1.100 to add Cargo dependency cooldowns after August crates.io supply chain compromise of arrayref, internment and append-only-vec

Rust 1.100, scheduled for November 12, 2026, will stabilize Cargo dependency cooldowns. Developers can reject newly published crate versions until they reach a configurable minimum age. The aim is to give researchers, maintainers and registries time to detect malicious releases before automated updates spread them across development envir…

technology software development

safedep.io · há 1d critical

Compromised Rust crate arrayref 0.3.10 pulls typosquat proc-macro1, whose build script downloads and runs a remote binary

On August 20, 2026, a compromised release of the Rust crate arrayref (0.3.10, about 245 million all-time downloads) appeared on crates.io. It added a dependency on the typosquatted crate proc-macro1 1.0.107, whose build script downloads and runs a remote binary at compile time. The maintainer account droundy appears to have been compromis…

technology software development