Post

Please be aware that this morning at about 07:10 UTC a malicious version (0.3.10, now removed) of the arrayref crate was published. This crate is a transitive dependency of iroh, via blake3 and might have made it onto your (CI) machine if you happened to cargo update between 07:10 and ~08:10 UTC.

The compromised crate depended on a fake proc-macro1 crate from a typosquatted maintainer. proc-macro1 in turn had a malicious build.rs file which downloaded an unknown payload. That payload remains running afterwards, and connects to 23.254.165.112. More is not yet known about it.

Other popular crates that were compromised at the same time were internment and append-only-vec which also had their dependency changed to the malicious proc-macro1 crate.

Please be careful if any of your CI jobs ran during this period, or if you did a build yourself. Consider the machines and any credentials on it compromised. A simple check is to look for the malicious crates in ~/.cargo/registry/src/, but that is not comprehensive and depends on your setup.