Backdoored Rust packages hit crates.io, exposing developers to malware at build time

Malicious versions of three Rust packages, including the widely used arrayref, were published to the crates.io registry on August 20, carrying a backdoor that executed automatically when affected projects were compiled. Security researchers at Wiz said the attack also shares infrastructure with recent supply-chain campaigns attributed to North Korean threat actors. The compromised releases were “arrayref@0.3.10”, “internment@0.8.7,” and “append-only-vec@0.1.9.” All three introduced a dependency