Les d\u00e9veloppeurs du langage Rust ont averti de la d\u00e9couverte dans le d\u00e9p\u00f4t crates.io d'un paquet rustdecimal contenant du code malveillant. Ce paquet \u00e9tait bas\u00e9 sur le paquet l\u00e9gitime rust_decimal et tirait parti de la similarit\u00e9 de nom (typosquatting) en comptant sur le fait que l'utilisateur ne remarquerait pas l'absence de symbole de soulignement lors de la recherche ou de la s\u00e9lection du module dans la liste. <\/p>\n
Il est \u00e0 noter que cette strat\u00e9gie s'est r\u00e9v\u00e9l\u00e9e efficace, et en termes de t\u00e9l\u00e9chargements, le paquet fictif a l\u00e9g\u00e8rement ralenti par rapport \u00e0 l'original (~111 000 t\u00e9l\u00e9chargements de rustdecimal 1.23.1 contre 113 000 de rust_decimal 1.23.1). La plupart des t\u00e9l\u00e9chargements provenaient d'un clone inoffensif ne contenant pas de code malveillant. Des modifications malveillantes ont \u00e9t\u00e9 ajout\u00e9es le 25 mars dans la version rustdecimal 1.23.5, qui, avant le signalement du probl\u00e8me et le blocage du paquet, avait \u00e9t\u00e9 t\u00e9l\u00e9charg\u00e9e environ 500 fois (on suppose que la majorit\u00e9 des t\u00e9l\u00e9chargements de la version malveillante ont \u00e9t\u00e9 effectu\u00e9s par des bots) et n'a pas \u00e9t\u00e9 utilis\u00e9e dans les d\u00e9pendances d'autres paquets pr\u00e9sents dans le d\u00e9p\u00f4t (il n'est pas exclu que le paquet malveillant ait \u00e9t\u00e9 dans les d\u00e9pendances d'applications finales). <\/p>\n
Les modifications malveillantes consistaient en l'ajout d'une nouvelle fonction Decimal::new, dont l'impl\u00e9mentation contenait un code obfusqu\u00e9 pour t\u00e9l\u00e9charger depuis un serveur externe de serveurs<\/a> et ex\u00e9cuter un fichier ex\u00e9cutable. Lors de l'appel de cette fonction, une v\u00e9rification de la variable d'environnement GITLAB_CI \u00e9tait effectu\u00e9e ; si elle \u00e9tait configur\u00e9e, un fichier \/tmp\/git-updater.bin \u00e9tait t\u00e9l\u00e9charg\u00e9 depuis un serveur externe. Le gestionnaire malveillant t\u00e9l\u00e9charg\u00e9 \u00e9tait compatible avec Linux et macOS (la plateforme Windows n'\u00e9tait pas support\u00e9e). <\/p>\n On supposait que la fonction malveillante serait ex\u00e9cut\u00e9e lors des tests sur des syst\u00e8mes d'int\u00e9gration continue. Apr\u00e8s le blocage de rustdecimal, les administrateurs de crates.io ont analys\u00e9 le contenu du d\u00e9p\u00f4t \u00e0 la recherche d'inserts malveillants similaires, mais n'ont trouv\u00e9 aucun probl\u00e8me dans d'autres paquets. Il est recommand\u00e9 aux propri\u00e9taires de syst\u00e8mes d'int\u00e9gration continue bas\u00e9s sur GitLab de s'assurer que les projets test\u00e9s n'utilisent pas le paquet rustdecimal dans leurs d\u00e9pendances. serveurs<\/a> Les d\u00e9veloppeurs du langage Rust ont averti de la d\u00e9couverte dans le d\u00e9p\u00f4t crates.io d'un paquet rustdecimal contenant du code malveillant. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u044f\u0437\u044b\u043a\u0430 Rust \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 crates.io \u043f\u0430\u043a\u0435\u0442\u0430 rustdecimal, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u041f\u0430\u043a\u0435\u0442 \u0431\u044b\u043b \u043e\u0441\u043d\u043e\u0432\u0430\u043d \u043d\u0430 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 rust_decimal \u0438 \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0441\u0445\u043e\u0434\u0441\u0442\u0432\u043e\u043c \u0432 \u0438\u043c\u0435\u043d\u0438 (\u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433) \u0441 \u0440\u0430\u0441\u0447\u0451\u0442\u043e\u043c \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043d\u0435 \u043e\u0431\u0440\u0430\u0442\u0438\u0442 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u0430 \u043f\u043e\u0434\u0447\u0451\u0440\u043a\u0438\u0432\u0430\u043d\u0438\u044f, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u044f \u043f\u043e\u0438\u0441\u043a \u0438\u043b\u0438 \u0432\u044b\u0431\u0438\u0440\u0430\u044f \u043c\u043e\u0434\u0443\u043b\u044c \u0438\u0437 \u0441\u043f\u0438\u0441\u043a\u0430. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u0430\u044f \u0441\u0442\u0440\u0430\u0442\u0435\u0433\u0438\u044f \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104002","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Un paquet malveillant rustdecimal a \u00e9t\u00e9 trouv\u00e9 dans le d\u00e9p\u00f4t Rust crates.io | ProHoster","description":"\ud83e\udd47Un paquet malveillant rustdecimal a \u00e9t\u00e9 trouv\u00e9 dans le d\u00e9p\u00f4t Rust crates.io | ProHoster","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-rust-repozitorii-crates-io-vyyavlen-vredonosnyj-paket-rustdecimal","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Rust-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 crates.io \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043f\u0430\u043a\u0435\u0442 rustdecimal | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u044f\u0437\u044b\u043a\u0430 Rust \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 crates.io \u043f\u0430\u043a\u0435\u0442\u0430 rustdecimal, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-rust-repozitorii-crates-io-vyyavlen-vredonosnyj-paket-rustdecimal","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-05-11T07:36:37+00:00","article:modified_time":"2022-05-11T07:36:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104002","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 16:03:02","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-05-11 07:37:47","updated":"2026-02-22 16:03:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/104002","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=104002"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/104002\/revisions"}],"predecessor-version":[{"id":164415,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/104002\/revisions\/164415"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=104002"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=104002"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=104002"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"