Crates.io Supply-Chain Compromise Uses proc-macro1 Typosquat...

src/pentesting-ci-cd/pentesting-ci-cd-methodology.md

@@ -122,6 +122,16 @@ Compromising a CI/CD pipeline or stealing credentials from it can let an attacke
 - **Workflow injection with stolen GitHub tokens**: a token with **`repo` + `workflow`** permissions can create a branch, commit a malicious file inside `.github/workflows/`, trigger it, collect the produced artifacts/logs, and then delete the temporary branch/workflow run to reduce traces.<sup>[[14]](#references)[[15]](#references)[[16]](#references)[[17]](#references)[[36]](#references)</sup>
 - **Wormable registry propagation**: stolen npm tokens should be validated for **publish** permissions and whether they bypass 2FA. If they do, enumerate writable packages, download their tarballs, inject a loader such as `setup.mjs`, set `preinstall` to execute it, bump the patch version, and republish. This turns one CI compromise into downstream auto-execution in other environments.<sup>[[2]](#references)[[23]](#references)[[24]](#references)[[25]](#references)</sup>
 
+#### Cargo transitive dependencies and `build.rs` execution
+
+Cargo normally compiles and runs a package's root `build.rs` before building that package. The script can use crates listed under `[build-dependencies]`. Thus, `cargo build` or `cargo check` can execute a transitive dependency's build script on a developer or CI host even when the project never calls that crate's library API.<sup>[[46]](#references)[[47]](#references)</sup>
+
+A compromised publisher can add a lookalike crate as a dependency of a trusted crate and put the malicious behavior in the lookalike's `build.rs`. Its ordinary library source can still appear legitimate. A fresh resolution or `cargo update` can add that crate to `Cargo.lock`, but the script runs only when Cargo subsequently builds or checks it, not when the lockfile is updated.<sup>[[46]](#references)[[47]](#references)</sup>
+
+To trace a suspicious crate in an already resolved project, inspect `Cargo.lock` and run `cargo tree --locked -i proc-macro1` from the relevant workspace member; `--workspace` extends reverse-dependency output across the workspace.<sup>[[48]](#references)</sup> Compare the published crate's `Cargo.toml`, `build.rs`, and build dependencies with its previous version and the legitimate crate it imitates, rather than trusting only its repository; see [published-artifact checks](#practical-checks-during-an-assessment).<sup>[[46]](#references)</sup>
+
+On Windows, a long-running child of a Cargo build script can stay in Cargo's job object and stall the build. The reported dropper used a hidden `wscript`/VBS-to-PowerShell launcher to detach it instead of spawning it directly from `build.rs`.<sup>[[46]](#references)</sup>
+
 #### Package integrity when the serving source is compromised
 
 A compromised registry, mirror, CDN, or Git host can serve altered bytes for a dependency whose name and version have not changed. This differs from taking over a publisher account: TLS still authenticates the compromised endpoint, while a version pin alone does not authenticate the downloaded artifact. A lockfile hash helps only if its expected value was obtained through a trusted channel and the installer rejects a mismatch instead of accepting a new hash from that same source.<sup>[[37]](#references)</sup>
@@ -207,5 +217,8 @@ Check this article about the top 10 CI/CD risks according to Cider: [**https://w
 - [43] [Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow](https://rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229)
 - [44] [GitLab CI Lint API](https://docs.gitlab.com/api/lint/)
 - [45] [Ruby 3.3.12 regex recompilation source](https://github.com/ruby/ruby/blob/v3_3_12/re.c#L1586-L1664)
+- [46] [Crates.io Supply-Chain Compromise Uses proc-macro1 Typosquat to Infect Rust Builds](https://research.jfrog.com/post/arrayref-proc-macro1-crates-io)
+- [47] [Cargo Build Scripts](https://doc.rust-lang.org/cargo/reference/build-scripts.html)
+- [48] [cargo tree](https://doc.rust-lang.org/cargo/commands/cargo-tree.html)
 
 {{#include ../banners/hacktricks-training.md}}