41
crates.io: Malicious crates faster_log and async_println | Rust Blog (blog.rust-lang.org)
submitted 1 year ago by to c/rust@programming.dev
9 comments fedilink hide all child comments

all 9 comments

sorted by: hot top controversial new old
[–] 5 points 1 year ago (1 child)

Not again...

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 3 points 1 year ago

    Damn, expected something like this to happen or, well, be detected after the big NPM attacks.

  • permalink
  • fedilink
  • source
    •
    [–] 2 points 1 year ago

    Seriously more effort and investment should be put into code scanners if we want a bright future to modern software development

  • permalink
  • fedilink
  • source
    •
    [–] 1 point 1 year ago (4 children)

    What are the proper crates that the malicious ones were pretending to be? (I'm new to Rust)

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 4 points 1 year ago (3 children)

    Both were impersonating fast_log.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 1 year ago* (2 children)

    Thanks :)

    async_println is a part of fast_log?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 5 points 1 year ago* (1 child)

    Both faster_log and async_println were purely malicious packages (not taken over and turned malicious).

    I know faster_log is typosquatting / luring fast_log users but I’m not sure about about async_println (which was a clone of the malicious faster_log).

    async_std::print is a thing so I guess trying to lure users who search crates before docs :shrug:

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •