Malicious versions only lived on crates.io for a little over two hours.
Don’t get distracted by that 264 million download count.
StepSecurity revealed that three commonly used Rust packages had malicious dependencies added—remote code will be executed during the build.
A lot of people start panicking as soon as they see the download numbers.
But that figure is the historical cumulative number of downloads. The malicious versions, at most, only caused trouble for a little over two hours.
What you really need to watch out for is anyone who ran cargo update today—the build chain may have already pulled the malicious version into your dependencies.
Don’t get distracted by that 264 million download count.
StepSecurity revealed that three commonly used Rust packages had malicious dependencies added—remote code will be executed during the build.
A lot of people start panicking as soon as they see the download numbers.
But that figure is the historical cumulative number of downloads. The malicious versions, at most, only caused trouble for a little over two hours.
What you really need to watch out for is anyone who ran cargo update today—the build chain may have already pulled the malicious version into your dependencies.