Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

Malicious versions of three popular Rust crates were briefly available on crates.io, a package repository, after a compromised maintainer account published them. These releases contained a build script that, during compilation, would download and execute a remote payload. The affected crates were quickly removed, and there is no evidence of widespread use, but developers are advised to check their systems and pin to older, safe versions of the affected libraries.