# I-Rust crate yasebenzisa i-malware ngesikhathi sokuhlanganisa. Imizuzu engu-86. Published: 2026-09-15 I-Rust crate enama-macro amane anokulandwa okungu-260 million yengeza ukuncika okukodwa, futhi i-"cargo build" isebenzisa i-binary yomuntu ongaziwa emshinini wakho. Agasti 20, 2026: i-arrayref 0.3.10 ifika ku-crates.io incike ku-proc-macro1 — hhayi i-proc-macro2, eyangempela — isikripthi sayo sokwakha silanda umthwalo, siwufake ku-/tmp/rust-setup bese siwuvusa ngokuhlukene ngenkathi iphrojekthi yakho ihlanganiswa. Izinguqulo ezihlanzekile ziyasuswa ngakho-ke isixwayiso se-Cargo sikuhambisa kuleyo enobuthi. Imizuzu engu-86 kamuva iyasuswa. Canonical: https://thedailydiff.dev/zu/video/2026-09-15-arrayref-proc-macro/ ## Lokho okuhlanganiswa yile vidiyo - i-cargo build isebenzisa i-binary yomuntu ongaziwa - Amalungu: Rust Blog, SafeDep, Hacker News - Lena yi-The Daily Diff, i-postmortem - Umgomo wesikhathi: 02:11 ukuhlola → 07:15 kushicilelwe → 08:41 kususwe - Indlela: build.rs, akukho sandbox, i-yank lure ## Izahluko - 0:00 i-cargo build isebenzisa i-binary yomuntu ongaziwa - 0:20 Amalungu: Rust Blog, SafeDep, Hacker News - 0:33 Lena yi-The Daily Diff, i-postmortem - 0:40 Umgomo wesikhathi: 02:11 ukuhlola → 07:15 kushicilelwe → 08:41 kususwe - 1:25 Indlela: build.rs, akukho sandbox, i-yank lure - 2:05 git blame — ukuhlukana - 2:25 Umsakazo wokuqhuma: 2,285 ukulandwa - 2:45 Isinqumo + umugqa wangoMsombuluko ## Umbhalo obhaliwe ohunyushwe Kuhunyushwe kusuka ekulandiseni kokuqala kwesiNgisi. Umsindo namazwibela atholakalayo alawulwa yi-YouTube. ### i-cargo build isebenzisa i-binary yomuntu ongaziwa 0:00 I-Rust crate enama-macro amane enokulandwa okungamakhulu amabili namashumi ayisithupha ezigidi yengeza okukodwa ukuncika, futhi i-cargo build isebenzisa i-binary yomuntu ongaziwa emshinini wakho. Agasti 20, 2026. i-arrayref 0.3.10 ifika ku-crates.io incike ku-proc-macro1. Hhayi i-proc-macro2, eyangempela: idijithi eyodwa iphume, futhi isikripthi sayo sokwakha sisebenzisa i-payload ngenani iphrojekthi yakho ihlanganiswa. Ithimba lezokuphepha le-Rust liyayisusa emizuzwini engu-86 kamuva. ### Amalungu: Rust Blog, SafeDep, Hacker News 0:22 I-SafeDep ishicilela ukususa. Hacker News: amaphuzu angu-554. Kwenzeka kanjani, kungani i-Cargo ikuvumela, futhi ubani ozothola icala. Lena yi-The Daily Diff, i-postmortem. Ngo-02:00 ekuseni, UTC. ### Lena yi-The Daily Diff, i-postmortem 0:33 I-akhawunti ebizwa nge-d-tolney, igama elilodwa ku-David Tolnay, onakekela ingxenye ye-Rust, ishicilela i-proc-macro1 1.0.106: i-proc-macro2 yangempela, ### Umgomo wesikhathi: 02:11 ukuhlola → 07:15 kushicilelwe → 08:41 kususwe 0:41 iqanjwe kabusha. Ukuhlola. 07:11. Inguqulo 1.0.107 yengeza isikripthi sokwakha, kanye i-base64, i-TLS kanye neklayenti le-HTTP. Nge-token parser. 07:15. I-akhawunti yomlungisi ishicilela kabusha i-arrayref njengo-0.3.10 futhi isusa zonke izinhlobo ezindala. I-Cargo iphrinta: cabanga ukubuyekeza inguqulo engasuswanga. Okuwukuphela kosala yile enobuthi. 1:02 Isixwayiso yilo olukhohlisayo. Ngeminithi efanayo, inkampani yezokuphepha iyayibika ku-Rust. 07:54, inkinga ye-RustSec. 08:29, inkinga ku-repo; umhlaseli uphendula ngo-0.3.11 kanye nokuncika okubi kwesibili. 08:41, kususwe. Imizuzu engamashumi ayisishiyagalombili nesithupha. Kungani? Okukodwa: I-Cargo yakha konke ukuncika okumenyezelwe, kubiziwe noma cha. Umugqa owodwa wombhalo wanele. 1:21 Okwesibili: isikripthi sokwakha sisebenza emshinini wakho, njengawe, ngezinkinobho zakho ze-SSH kanye ne-cargo ### Indlela: build.rs, akukho sandbox, i-yank lure 1:26 i-token, ngaphambi kokuba ikhodi yakho ihlanganiswe. Akukho sandbox, ngokuhlela: yile ndlela ama-crate athola ngayo imitapo yolwazi ye-C. Okwesithathu: ngaphakathi kukhona i-proc-macro2 yangempela, ngakho ukwakha kuphumelela. I-payload: iklayenti le-TLS elithemba noma isiphi isitifiketi lithola i-binary, liyifaka ku-/tmp/rust-setup bese liyivusa ngokuhlukene. Ku-Windows idlula nge-wscript ukuze ibaleke i-Cargo's job object; umthombo umbono uthi kunjalo. Isigaba sesibili, ngokwe-RustSec thread: ithuluzi lokufinyelela kude eliqondise ku- 1:52 iziphequluli nama-crypto wallets. Kubuhle, njengoba abasebenzisi abakhulu be-arrayref bebandakanya i-secp256k1 ne-Solana. git blame. Imodeli ye-Cargo, amaphesenti angamashumi amahlanu nanhlanu: ukuncika kusebenzisa ikhodi kumshini wakho ngesikhathi sokuhlanganisa, akukho sandbox, futhi isixwayiso sokususa sahambisa abantu ku- ### git blame — ukuhlukana 2:07 ubuthi. I-akhawunti eyodwa, amashumi amathathu: igama lokungena elilodwa ishicilela kabusha i-crate enengxenye eyodwa kwezine ukwethemba okuyizigidi. Idijithi eyodwa, amashumi nanhlanu: ukushaya okukodwa kokhiye ku-crate ethenjwe kakhulu ye-Rust, futhi akekho ofunda isihlahla. Umsakazo wokuqhuma: 2,285 ukulandwa emizuzwini engu-86. Ngaphandle kwamaphesenti ayishumi omgwaqo, ngoba iningi lama-lockfile lalibambe u-0.3.9. i-crates.io ithi akukho ubufakazi bokusebenzisa. ### Umsakazo wokuqhuma: 2,285 ukulandwa 2:27 Abantu ababili ku-RustSec thread abavumelani; omunye uthola isevisi ye-systemd. Ku-Hacker News i-thread ephezulu ayikhulumi nge-malware. Yikhasi le-crate, lapho u-0.3.10 manje akazange abe khona. Isinqumo, i-postmortem: NEEDS REVIEW. Imizuzu engamashumi ayisishiyagalombili nesithupha yokususa, okuthunyelwe kubhulogi ngosuku olufanayo, i-akhawunti ikhiyiwe: leyo ingxenye i-SHIP IT. Kodwa ikhasi le-crate likhombisa ukuthi akukho okwenzekile, i-cargo audit ithula kukhophi egcinwe ku-cache ### Isinqumo + umugqa wangoMsombuluko 2:48 futhi izikripthi zokwakha zisasebenza njengawe. UMsombuluko: sebenzisa umyalo wokuthola we-Rust blog, futhi uphathe isixwayiso sokususa njengombuzo, hhayi umyalo. Ngithumele isigameko ongakavunyelwa ukukhuluma ngaso, emazwaneni, noma ku-the daily diff dot dev. Futhi yilokho umehluko namuhla. Ngingu-Niko wase-Axrisi. Hlanganisa ngokuzibophezela. ## Imithombo - [Rust Blog, "Supply chain attack on arrayref" (security-response, Aug 20, 2026)](https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/) — blog.rust-lang.org - [RUSTSEC-2026-0260 (arrayref)](https://github.com/rustsec/advisory-db/blob/main/crates/arrayref/RUSTSEC-2026-0260.md) — github.com - [RustSec issue #3161 (the original report, IOCs, victims)](https://github.com/rustsec/advisory-db/issues/3161) — github.com - [SafeDep technical analysis](https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/) — safedep.io - [GitHub issue on the repo (0.3.11 spotted)](https://github.com/droundy/arrayref/issues/33) — github.com - [crates.io](https://crates.io/crates/arrayref) — crates.io - [Hacker News (554 points)](https://news.ycombinator.com/item?id=49374269) — news.ycombinator.com - [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-poison-arrayref-rust-crate-to-push-infostealer-malware/) — www.bleepingcomputer.com