[carlospolop]

Blog URL

https://research.jfrog.com/post/arrayref-proc-macro1-crates-io

Blog Title

Crates.io Supply-Chain Compromise Uses proc-macro1 Typosquat to Infect Rust Builds

Blog high summary

Scope: A crates.io account/publish compromise released arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9 with transitive typosquat proc-macro1@1.0.107. Cargo executed its copied build.rs, which reconstructed split-Base64 C2 URLs, accepted invalid TLS certificates, downloaded an OS-specific payload, and launched it during builds or checks.

Any developer or CI host that refreshed a lockfile around 07:00–08:00 UTC could execute the unavailable second stage and should be treated as potentially compromised. Pin clean releases, regenerate lockfiles, hunt drop paths and IOCs, block 23.254.165.112 on ports 9089/443, rotate credentials, and investigate persistence.

PR changes

• src/pentesting-ci-cd/pentesting-ci-cd-methodology.md: Added a Cargo supply-chain subsection covering transitive build-script execution, dependency tracing, published-crate review, and Windows process detachment.

Errors

mdbook build unavailable

[carlospolop]

Decision: keep

The base book covers npm install hooks and published-artifact inspection, but a search found no Cargo build-script coverage. JFrog’s primary analysis and the Cargo documentation support the retained details. Incident-specific downloader details were removed. PR #516 has no comments, including no exact merge comment. Reference, anchor, SUMMARY, forbidden-source, and git diff checks passed.

Head: 85d167baa36b9f29bc6babf31b6998d74dcb7027

[carlospolop]

merge