Hackers poison popular Rust crates to steal developers' credentials

Attackers published poisoned updates to multiple popular Rust crates (notably arrayref, internment, and append-only-vec) that added a typosquatted dependency (proc-macro1) whose build script downloaded and executed multi-platform infostealer payloads targeting Chromium browser data and crypto wallet extension storage; the malicious releases were live for under two hours but could have been widely pulled due to the packages' popularity, and developers are urged to check lockfiles and caches for affected packages.