Udviklerne af sproget Rust har advaret om, at der er opdaget en pakke kaldet rustdecimal i repoet crates.io, som indeholder skadelig kode. Pakken var baseret p\u00e5 den legitime pakke rust_decimal og udnyttede ligheden i navnet (typosquatting) med h\u00e5bet om, at brugeren ikke ville l\u00e6gge m\u00e6rke til manglen p\u00e5 understregningstegn, n\u00e5r de s\u00f8gte eller valgte en modul fra listen. <\/p>\n
Det er bem\u00e6rkelsesv\u00e6rdigt, at den n\u00e6vnte strategi viste sig at v\u00e6re succesfuld, da den falske pakke kun var lidt bagefter originalen i antal downloads (~111.000 downloads af rustdecimal 1.23.1 og 113.000 af den originale rust_decimal 1.23.1). De fleste downloads var dog af den harml\u00f8se klon, som ikke indeholdt skadelig kode. De skadelige \u00e6ndringer blev tilf\u00f8jet den 25. marts i version rustdecimal 1.23.5, som f\u00f8r problemet blev opdaget og pakken blev blokeret, var blevet downloadet omkring 500 gange (det antages, at st\u00f8rstedelen af downloads af den skadelige version blev foretaget af bots) og ikke var blevet brugt i afh\u00e6ngighederne af andre pakker i repoet (det er ikke udelukket, at den skadelige pakke var i afh\u00e6ngighederne af de endelige applikationer). <\/p>\n
De skadelige \u00e6ndringer bestod i tilf\u00f8jelsen af den nye funktion Decimal::new, hvor implementeringen indeholdt obfuskeret kode til downloading fra eksterne kilder server<\/a> og udf\u00f8relse af en eksekverbar fil. Ved kald af funktionen blev der udf\u00f8rt en kontrol af milj\u00f8variablen GITLAB_CI; hvis denne var sat, blev en fil \/tmp\/git-updater.bin downloadet fra en ekstern server. Den downloadede skadelige handler underst\u00f8ttede drift p\u00e5 Linux og macOS (Windows-platformen blev ikke underst\u00f8ttet). <\/p>\n Det blev antaget, at den skadelige funktion ville blive udf\u00f8rt under testning p\u00e5 systemer til kontinuerlig integration. Efter blokeringen af rustdecimal udf\u00f8rte administratorerne p\u00e5 crates.io en analyse af indholdet i repoet for at finde lignende skadelige indskud, men fandt ikke problemer i andre pakker. Ejere af CI-systemer baseret p\u00e5 GitLab-platformen anbefales at sikre sig, at de testede deres servere<\/a> projekter ikke har brugt pakken rustdecimal i deres afh\u00e6ngigheder. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u044f\u0437\u044b\u043a\u0430 Rust \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 crates.io \u043f\u0430\u043a\u0435\u0442\u0430 rustdecimal, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u041f\u0430\u043a\u0435\u0442 \u0431\u044b\u043b \u043e\u0441\u043d\u043e\u0432\u0430\u043d \u043d\u0430 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 rust_decimal \u0438 \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0441\u0445\u043e\u0434\u0441\u0442\u0432\u043e\u043c \u0432 \u0438\u043c\u0435\u043d\u0438 (\u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433) \u0441 \u0440\u0430\u0441\u0447\u0451\u0442\u043e\u043c \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043d\u0435 \u043e\u0431\u0440\u0430\u0442\u0438\u0442 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u0430 \u043f\u043e\u0434\u0447\u0451\u0440\u043a\u0438\u0432\u0430\u043d\u0438\u044f, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u044f \u043f\u043e\u0438\u0441\u043a \u0438\u043b\u0438 \u0432\u044b\u0431\u0438\u0440\u0430\u044f \u043c\u043e\u0434\u0443\u043b\u044c \u0438\u0437 \u0441\u043f\u0438\u0441\u043a\u0430. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u0430\u044f \u0441\u0442\u0440\u0430\u0442\u0435\u0433\u0438\u044f \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104002","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47En skadelig pakke rustdecimal er blevet opdaget i Rust-repoet crates.io | ProHoster","description":"Udviklerne af sproget Rust har advaret om, at der er opdaget en pakke kaldet rustdecimal i repoet crates.io, som indeholder skadelig kode.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/v-rust-repozitorii-crates-io-vyyavlen-vredonosnyj-paket-rustdecimal","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Rust-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 crates.io \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043f\u0430\u043a\u0435\u0442 rustdecimal | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u044f\u0437\u044b\u043a\u0430 Rust \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 crates.io \u043f\u0430\u043a\u0435\u0442\u0430 rustdecimal, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/v-rust-repozitorii-crates-io-vyyavlen-vredonosnyj-paket-rustdecimal","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-05-11T07:36:37+00:00","article:modified_time":"2022-05-11T07:36:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104002","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 16:03:02","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-05-11 07:37:47","updated":"2026-02-22 16:03:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/104002","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=104002"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/104002\/revisions"}],"predecessor-version":[{"id":164415,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/104002\/revisions\/164415"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=104002"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=104002"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=104002"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"