Rogue Dependency Enables Arbitrary Code Execution in append-only-vec

Executive Summary

This vulnerability involves the append-only-vec crate 0.1.9 for Rust, which contains a malicious dependency that registers with a command-and-control server to enable arbitrary code execution during project compilation. The compromised crate was published and removed within 107 minutes with no evidence of actual usage.

Useful 0 Not Useful 0

Detection Guidance

Check for the presence of the malicious crate 'append-only-vec' version 0.1.9 in your project's dependencies. Inspect build scripts for unexpected network connections or file modifications. Look for files named 'rust-setup' or 'rust-setup.ps1' in temporary directories.

Useful 0 Not Useful 0

Impact Analysis

If you compile a project using the append-only-vec crate 0.1.9, the malicious dependency could execute arbitrary code on your system during the build process. This could lead to unauthorized access, data theft, or further compromise of your development environment.

Useful 0 Not Useful 0

Mitigation Strategies

Remove 'append-only-vec' version 0.1.9 from your project dependencies. Audit other dependencies for similar malicious crates like 'proc-macro1' or related typosquatted packages. Update to clean versions if available.

Useful 0 Not Useful 0