{"schema_version":"1.0","service":"Publicasta","type":"article","id":369,"slug":"rust_arrayref_supply_chain_attack_cargo_build_scripts_2026","title":"Инцидент с Rust arrayref — предупреждение о доверии к сборке в open source","excerpt":"Вредоносный релиз arrayref был доступен меньше двух часов, но вскрыл более глубокую проблему open source: package managers часто запускают код зависимостей во время сборки раньше, чем команда решила, насколько ему доверяет.","language":"ru","default_language":"en","canonical_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=ru","image":{"url":"https://publicasta.com/storage/projects/10/pages/369/2026/08/8ceaa39d-9547-4785-b052-4a0bab519bd7.webp","alt":"Подозрительный пакет в графе open-source зависимостей и CI-пайплайне"},"publisher":{"id":10,"slug":"open_source_radar","name":"Open Source радар","url":"https://publicasta.com/open_source_radar"},"author":{"name":"Anton R"},"published_at":"2026-08-21T06:48:07+00:00","updated_at":"2026-08-21T06:48:07+00:00","content_markdown":"Атака на Rust crate `arrayref` была короткой, узкой и всё равно важной. По данным Rust Security Response Team, вредоносные версии, связанные с `arrayref`, `internment` и `append-only-vec`, удалили с crates.io за окна в 86, 90 и 107 минут. Официальный Rust blog подчёркивает, что легитимный maintainer `arrayref` не считается злонамеренным; рабочая версия — компрометация компьютера или credentials. Быстрая реакция — хорошая новость.\n\n ![Подозрительный пакет в графе open-source зависимостей и CI-пайплайне](https://publicasta.com/storage/projects/10/pages/369/2026/08/8ceaa39d-9547-4785-b052-4a0bab519bd7.webp)\n\n Но это не вся история. Для Open Source Radar инцидент важен потому, что затронул неприятный вопрос modern package managers: когда dependency собирается, какой code allowed to run, где он запускается и с какими credentials? Rust не npm, а crates.io не хаотичная экосистема. Но случай показал: маленькая, старая и скучная dependency может стать build-time execution path, если registry workflows, lifecycle hooks и developer convenience совпадут неудачно.\n\n `arrayref` — не модный framework. docs.rs описывает его как маленький модуль с четырьмя macros for taking array references to portions of arrays or slices. Именно поэтому кейс важен. Самая рискованная supply-chain dependency не всегда новая flashy library. Это может быть крошечная utility, которая годами тихо сидит в transitive dependency graph.\n\n ## Что произошло\n\n Rust blog сообщает, что 20 августа 2026 команда получила и проверила report о malicious `proc-macro1`. Attack path включал malicious releases established crates и attacker-owned crates. `arrayref@0.3.10` был опубликован в 07:15 UTC и удалён в 08:41:40 UTC; `internment@0.8.7` — с 07:34:07 до 09:04:11; `append-only-vec@0.1.9` — с 07:37:49 до 09:25:24.\n\n Команда также удалила attacker-owned crates: `proc-macro1`, `proc-macro-en`, `aovine`, `arone`, `aronenao`, `tinymember`. Legitimate versions, которые были maliciously yanked, восстановили, а affected account locked as precaution. GitHub Advisory Database опубликовала GHSA-jwh4-228v-r358 для `arrayref = 0.3.10`, classified as malicious code with no patched version.\n\n Технический трюк был понятным. SafeDep и другие разборы пишут, что `arrayref@0.3.10` добавил dependency на typosquatted `proc-macro1`. Такое имя легко принять за legitimate `proc-macro2` при беглом dependency diff. Malicious crate reportedly copied genuine `proc-macro2` source, чтобы builds продолжали выглядеть normal, while build script ran.\n\n Ключ здесь — build script. Cargo build scripts нужны для реальных задач: native libraries, generated bindings, platform detection, code generation and environment-specific configuration. Но эта же мощь означает: dependency can execute code at build time. Если это происходит на developer laptop или CI runner с tokens, SSH keys, cloud credentials or package publishing rights, даже короткое registry exposure window matters.\n\n ## Почему короткое окно опасно\n\n Легко сказать, что инцидент contained, потому что malicious versions были online less than two hours. Это слишком оптимистично. Modern CI fast, automatic and credential-rich. Dependency update, scheduled build, local `cargo update`, container image rebuild или bot-managed version bump в это окно могли запустить код.\n\n RustSec issue и secondary reports также описывают social-engineering detail: older versions of `arrayref` были yanked, поэтому malicious version could look like natural path forward for some update workflows. Package metadata и registry behavior — часть attack surface. Registry не нужно долго держать malicious version, если surrounding cues толкают automated systems к ней.\n\n Аккуратная позиция: не каждый проект, использующий `arrayref`, compromised. Но any system that built affected versions during exposure window should be treated as potentially exposed until logs, artifacts and credentials are reviewed. Popular crate с большими all-time download counts не означает, что malicious version массово использовалась. Нужны evidence, not fear.\n\n ## Что Rust сделал правильно\n\n Official response был быстрым и публичным. Rust team removed malicious crates, restored maliciously yanked legitimate versions, documented affected versions and timelines, and gave users a way to check local cargo caches. GitHub advisories and RustSec discussion followed quickly. Account locked as precaution. Legitimate maintainer was not blamed.\n\n Для open source это важно. Incidents inevitable; response quality determines whether trust repaired. Registry нужны deletion and yanking procedures, security response path, public advisories, coordination with downstream advisory databases and clear language distinguishing maintainer compromise from maintainer malice.\n\n Rust community тоже отреагировала полезно. Hacker News discussion quickly moved beyond blame into system design: sandboxing build scripts, build-script allowlists, registry anomaly detection, lockfile discipline, dependency culture, containerized development and whether tiny microcrates should be avoided when stdlib or local code can do the job.\n\n Это правильный разговор. Инцидент не доказывает, что Rust uniquely unsafe. Он доказывает, что no language ecosystem can ignore package-manager trust boundaries.\n\n ## Неприятный вопрос к Cargo\n\n Cargo build scripts — не ошибка. Во многих ecosystems есть lifecycle hooks or build-time execution: npm `postinstall`, Python build backends, configure scripts, Rust `build.rs`. Open source многократно выбирал convenience, portability and automation. Attackers замечают, что build systems run earlier and with more privilege than teams realize.\n\n Вопрос не “нужны ли build scripts”. Вопрос: should every new or changed build script run with full access by default? Small dependency, которая never needed build-time code, suddenly adds build dependency. Crate pulls typosquatted package. Build script can open network, inspect environment or touch files. В default setups developer often gets no strong, human-readable trust prompt before this happens.\n\n Cargo issue “Build script allowlist mode” и Rust project goal around sandboxed build scripts показывают, что community already thinking about this. Arrayref incident gives urgency. Future likely layered defense: better registry signals, explicit allowlists, sandboxed or restricted build execution, dependency diffs highlighting new build scripts, network-deny modes for CI, and stronger review of yanking and ownership changes.\n\n ## Что проверить разработчикам\n\n Сначала проверьте, есть ли affected versions в `Cargo.lock`, vendored dependencies, container build logs or artifact provenance. Relevant versions: `arrayref@0.3.10`, `internment@0.8.7`, `append-only-vec@0.1.9`, плюс deleted attacker-owned crates из Rust advisory. Local cargo caches и CI caches важны: crate может остаться after registry takedown.\n\n Далее inspect builds that ran during exposure windows on August 20, 2026. CI jobs, self-hosted runners, developer workstations, release builders and container image rebuilds. Если affected build ran with access to secrets, package tokens, cloud credentials, signing keys or SSH material, rotate what may have been exposed. Не ждите perfect attribution before protecting credentials.\n\n Review network egress from build jobs. Many builds do not need broad outbound network after dependencies fetched. If build script unexpectedly contacts external host, that should be visible. Hardened runners, egress policies, ephemeral CI machines and isolated containers reduce value of build-time payloads.\n\n Review update habits. Lockfiles не full defense, но помогают. Blindly updating transitive dependencies in privileged environments risky. Dependabot-style updates useful when paired with review, tests in containment and diffing that highlights new build scripts, new owners, yanks, proc macros or network-capable build dependencies.\n\n Use tools, но понимать limits. `cargo audit` and advisory databases help after malicious package known. `cargo deny` enforces policies. `cargo vet` records human trust decisions. Supply-chain scanners may detect suspicious behavior earlier. None replaces sandbox.\n\n ## Уроки для maintainers and registries\n\n Maintainers должны harden publishing accounts: strong authentication, scoped tokens where available, least privilege for automation, separate release machines, monitoring for unexpected yanks, owner changes or releases. Small utility crate can be critical infrastructure if enough projects depend transitively.\n\n Registries should treat unusual lifecycle changes as signals. Crate quiet for years suddenly adds build script, typosquatted build dependency, suspicious yanking of older versions or network-reaching behavior — needs friction. Friction can be warnings, delayed propagation, maintainer confirmation, automated scanning or stronger UI indicators.\n\n Tool authors have opportunity. Developers need dependency diffs showing not only source changes, but trust changes: new build scripts, proc macros, owners, publish tokens, native code, outbound network behavior, yanked predecessors and package names mimicking common crates.\n\n Standard-library debate will continue. Some HN commenters argued thin stdlib pushes teams into too many microdependencies. Reuse remains open-source strength, but every dependency is also trust relationship. Right answer is not “never use dependencies”; it is “make cost of adding and running dependency code visible.”\n\n ## Не только Rust\n\n Сравнение с npm postinstall attacks, PyPI typosquatting and registry compromises неизбежно. It is fair if not used for language tribalism. Rust has strong type safety and serious security culture. They do not remove registry compromise, maintainer credential theft, malicious build scripts or package-name social engineering.\n\n Broader open-source lesson: source code review no longer enough. Question is when code executes. Dependency that only appears in lockfile is one thing. Dependency with build script that runs before your application starts is another. Dependency that runs on CI runner holding release tokens is more sensitive still.\n\n Package managers and engineering teams need to model that difference. Build-time execution should be permission, not invisible side effect of reuse.\n\n ## Что стоит попробовать\n\n Для проектов: stricter dependency review workflow. Add checks for Rust advisories. Review `Cargo.lock` changes as signal, not noise. Keep build runners ephemeral. Remove long-lived secrets from general build jobs. Consider network restrictions after dependency fetch. Track which crates have build scripts and which are approved.\n\n Для critical software: experiment with `cargo vet` or equivalent human-review ledger. Use `cargo deny` or policy tooling to block known bad crates and suspicious sources. Feed RustSec and GitHub advisories into alerting. Evaluate third-party scanners for build-time behavior detection, not only source metadata.\n\n Для platform teams: put build isolation on roadmap. Containers are start, not complete answer. Self-hosted runners with broad credentials especially sensitive. MicroVMs, short-lived credentials, secretless build stages, artifact signing after isolated builds, and egress monitoring make this class less profitable.\n\n Для Rust ecosystem: watch Cargo and crates.io design. Build-script sandboxing, allowlist modes, stronger release anomaly detection and better consumer warnings can help without declaring every build script malicious. Arrayref incident is stress test; useful response is better defaults.\n\n ## Radar signal\n\n Open Source Radar should track this not because Rust failed uniquely, but because modern open source infrastructure is being tested: registries, lockfiles, advisories, maintainers, CI, package managers and hidden trust decisions in build automation.\n\n Good news: Rust response was quick and community debate technically serious. Warning: speed of response does not replace containment. If your build system can execute dependency code, your build system is part of your security boundary.\n\n Next generation of open-source tooling should make that boundary explicit. Developers should not learn after an incident that a tiny macro crate could run a remote payload during build. Reuse remains one of open source’s greatest strengths. It needs a trust model that treats build-time code as code, not as harmless footnote.","available_translations":[{"language":"ar","title":"حادثة Rust arrayref تنبه إلى مخاطر الثقة أثناء build في open source","html_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=ar","markdown_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026.md?lang=ar","json_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026.json?lang=ar","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=ar"},{"language":"de","title":"Der Rust-arrayref-Vorfall warnt vor Build-Time-Vertrauen in Open Source","html_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=de","markdown_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026.md?lang=de","json_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026.json?lang=de","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=de"},{"language":"en","title":"Rust’s arrayref incident is a warning about build-time trust in open source","html_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=en","markdown_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026.md?lang=en","json_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026.json?lang=en","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=en"},{"language":"es","title":"El incidente de arrayref en Rust avisa sobre la confianza en la fase de build","html_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=es","markdown_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026.md?lang=es","json_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026.json?lang=es","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=es"},{"language":"fr","title":"L’incident Rust arrayref alerte sur la confiance accordée au build open source","html_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=fr","markdown_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026.md?lang=fr","json_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026.json?lang=fr","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=fr"},{"language":"pl","title":"Incydent Rust arrayref ostrzega przed zaufaniem do kodu uruchamianego przy buildzie","html_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=pl","markdown_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026.md?lang=pl","json_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026.json?lang=pl","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=pl"},{"language":"ru","title":"Инцидент с Rust arrayref — предупреждение о доверии к сборке в open source","html_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=ru","markdown_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026.md?lang=ru","json_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026.json?lang=ru","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=ru"},{"language":"zh","title":"Rust arrayref 事件提醒开源社区重新审视构建时信任","html_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=zh","markdown_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026.md?lang=zh","json_url":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026.json?lang=zh","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=zh"}],"_links":{"self":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026.json?lang=ru","api":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=ru","html":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=ru","canonical":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026?lang=ru","markdown":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026.md?lang=ru","json":"https://publicasta.com/open_source_radar/rust_arrayref_supply_chain_attack_cargo_build_scripts_2026.json?lang=ru","channel":"https://publicasta.com/api/public/v1/channels/open_source_radar","channel_articles":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles","search":"https://publicasta.com/api/public/v1/search","documentation":"https://publicasta.com/api-docs#reading-publicasta","openapi":"https://publicasta.com/api-docs/openapi.json","llms":"https://publicasta.com/llms.txt"}}