Post

Iroh
@iroh.computer

Please be aware that this morning at about 07:10 UTC a malicious version (0.3.10, now removed) of the arrayref crate was published. This crate is a transitive dependency of iroh, via blake3 and might have made it onto your (CI) machine if you happened to cargo update between 07:10 and ~08:10 UTC.

7 reposts22 likes

Iroh
@iroh.computer

The compromised crate depended on a fake proc-macro1 crate from a typosquatted maintainer. proc-macro1 in turn had a malicious build.rs file which downloaded an unknown payload. That payload remains running afterwards, and connects to 23.254.165.112. More is not yet known about it.

Iroh
@iroh.computer

Other popular crates that were compromised at the same time were internment and append-only-vec which also had their dependency changed to the malicious proc-macro1 crate.

Iroh
@iroh.computer

Please be careful if any of your CI jobs ran during this period, or if you did a build yourself. Consider the machines and any credentials on it compromised. A simple check is to look for the malicious crates in ~/.cargo/registry/src/, but that is not comprehensive and depends on your setup.