EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Lobsters·Aug 20·5 min read
Rust Supply-Chain Attack: arrayref 0.3.10 and the proc-macro1 Typosquat
TL;DR
The Rust crate arrayref version 0.3.10 was compromised, introducing a malicious dependency that executes harmful code during compilation. The Rust security community is actively investigating the incident.
✦ Why It Matters
Check your lockfiles for compromised versions and take immediate action if affected.
Key Takeaways
- Inspect Cargo.lock for arrayref version 0.3.10 or proc-macro1.
- Look for suspicious files in /tmp and %TEMP% directories.
- Rotate all credentials and tokens if compromised.
- Pin arrayref to version 0.3.9 to avoid future issues.
How It Works
The malicious build.rs in proc-macro1 1.0.107 fetches a payload from a remote server and executes it during the build process. It uses base64 fragments to reconstruct its infrastructure and disables certificate validation, allowing it to download and run the payload without raising alarms.