EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Hacker News·Aug 20·5 min read
Malicious Rust Crate Arrayref Runs a Build-Time Payload
TL;DR
A compromised version of the Rust crate arrayref introduced a build-time payload that executed a remote binary during compilation. The malicious version has since been removed from crates.io.
✦ Why It Matters
Review your project's dependencies regularly to ensure they are secure and free from malicious code.
Key Takeaways
- Regularly audit your project's dependencies for security vulnerabilities.
- Avoid using typosquatted packages by verifying publisher identities.
- Stay updated on security advisories related to your dependencies.
- Implement automated tools to detect malicious code in build scripts.
How It Works
The malicious build script in proc-macro1 reconstructs a server address from base64 fragments and downloads a binary during compilation. This binary is executed without waiting for the build process to complete, allowing it to run in the background.