The malicious code ran at build time
The attack did not require developers to execute suspicious code or even call a function from arrayref. “Because Rust build scripts run at compile time, simply building any project whose lockfile resolved arrayref 0.3.10 was enough to detonate the payload. The crate’s code never needs to be called,” StepSecurity researchers said.
When the affected package was built, the “Cargo.toml” configuration file added proc-macro1 as a dependency. This dependency then reconstructed a command-and-control (C2) URL from Base64 fragments, disabled TLS certificate validation, downloaded a platform-specific payload, and executed it as part of the normal build process.
Wiz found the payload collecting host, username, and operating-system information, enumerating installed applications and inspecting Chrome, Brave, and Edge profiles for saved-login and extension information.
Click Here For The Original Source.
