Dezvoltatorii limbajului Rust au avertizat despre descoperirea \u00een depozitul crates.io a pachetului rustdecimal, care con\u021binea cod d\u0103un\u0103tor. Pachetul a fost creat pe baza unui pachet legitim, rust_decimal, \u0219i a folosit similaritatea de nume (tipus de stivuire) \u00een speran\u021ba c\u0103 utilizatorul nu va observa absen\u021ba caracterului de subliniere atunci c\u00e2nd caut\u0103 sau selecteaz\u0103 modulul din list\u0103. <\/p>\n
Este remarcabil c\u0103 strategia men\u021bionat\u0103 a avut succes, iar num\u0103rul desc\u0103rc\u0103rilor pachetului fals a fost doar pu\u021bin \u00een urma originalului (~111 mii desc\u0103rc\u0103ri rustdecimal 1.23.1 \u0219i 113 mii pentru rust_decimal 1.23.1). Majoritatea desc\u0103rc\u0103rilor au fost pentru clonele nevinovate, care nu con\u021bineau cod d\u0103un\u0103tor. Modific\u0103rile d\u0103un\u0103toare au fost ad\u0103ugate pe 25 martie \u00een versiunea rustdecimal 1.23.5, care, \u00eenainte de a fi identificat\u0103 problema \u0219i blocat\u0103, a fost desc\u0103rcat\u0103 de aproximativ 500 de ori (se presupune c\u0103 majoritatea desc\u0103rc\u0103rilor versiunii d\u0103un\u0103toare au fost efectuate de bo\u021bi) \u0219i nu a fost utilizat\u0103 \u00een dependen\u021bele altor pachete din depozit (nu se exclude posibilitatea ca pachetul d\u0103un\u0103tor s\u0103 fi fost \u00een dependen\u021bele aplica\u021biilor finale). <\/p>\n
Modific\u0103rile d\u0103un\u0103toare constau \u00een ad\u0103ugarea unei noi func\u021bii Decimal::new, \u00een implementarea c\u0103reia se afla cod obfuscat pentru a desc\u0103rca de pe exterior. server<\/a> \u0219i a lansa un fi\u0219ier executabil. La apelarea func\u021biei, se verifica variabila de mediu GITLAB_CI; \u00een cazul \u00een care era setat\u0103, un fi\u0219ier era desc\u0103rcat de pe un server extern \u00een \/tmp\/git-updater.bin. Handlerul d\u0103un\u0103tor desc\u0103rcat suporta func\u021bionarea pe Linux \u0219i macOS (platforma Windows nu era suportat\u0103). <\/p>\n Se presupunea c\u0103 func\u021bia d\u0103un\u0103toare urma s\u0103 fie executat\u0103 \u00een timpul test\u0103rii pe sistemele de integrare continu\u0103. Dup\u0103 blocarea rustdecimal, administratorii crates.io au efectuat o analiz\u0103 a con\u021binutului depozitului pentru a c\u0103uta inser\u021bii d\u0103un\u0103toare similare, dar nu au g\u0103sit probleme \u00een alte pachete. Este recomandat proprietarilor sistemelor de integrare continu\u0103 bazate pe platforma GitLab s\u0103 se asigure c\u0103 proiectele testate de ei. servere<\/a> nu au folosit pachetul rustdecimal \u00een dependen\u021bele lor. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u044f\u0437\u044b\u043a\u0430 Rust \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 crates.io \u043f\u0430\u043a\u0435\u0442\u0430 rustdecimal, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u041f\u0430\u043a\u0435\u0442 \u0431\u044b\u043b \u043e\u0441\u043d\u043e\u0432\u0430\u043d \u043d\u0430 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 rust_decimal \u0438 \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0441\u0445\u043e\u0434\u0441\u0442\u0432\u043e\u043c \u0432 \u0438\u043c\u0435\u043d\u0438 (\u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433) \u0441 \u0440\u0430\u0441\u0447\u0451\u0442\u043e\u043c \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043d\u0435 \u043e\u0431\u0440\u0430\u0442\u0438\u0442 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u0430 \u043f\u043e\u0434\u0447\u0451\u0440\u043a\u0438\u0432\u0430\u043d\u0438\u044f, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u044f \u043f\u043e\u0438\u0441\u043a \u0438\u043b\u0438 \u0432\u044b\u0431\u0438\u0440\u0430\u044f \u043c\u043e\u0434\u0443\u043b\u044c \u0438\u0437 \u0441\u043f\u0438\u0441\u043a\u0430. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u0430\u044f \u0441\u0442\u0440\u0430\u0442\u0435\u0433\u0438\u044f \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104002","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A fost identificat un pachet d\u0103un\u0103tor rustdecimal \u00een depozitul Rust crates.io | ProHoster","description":"Dezvoltatorii limbajului Rust au avertizat despre descoperirea \u00een depozitul crates.io a pachetului rustdecimal, care con\u021binea cod d\u0103un\u0103tor.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-rust-repozitorii-crates-io-vyyavlen-vredonosnyj-paket-rustdecimal","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Rust-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 crates.io \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043f\u0430\u043a\u0435\u0442 rustdecimal | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u044f\u0437\u044b\u043a\u0430 Rust \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 crates.io \u043f\u0430\u043a\u0435\u0442\u0430 rustdecimal, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-rust-repozitorii-crates-io-vyyavlen-vredonosnyj-paket-rustdecimal","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-05-11T07:36:37+00:00","article:modified_time":"2022-05-11T07:36:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104002","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 16:03:02","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-05-11 07:37:47","updated":"2026-02-22 16:03:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/104002","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=104002"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/104002\/revisions"}],"predecessor-version":[{"id":164415,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/104002\/revisions\/164415"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=104002"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=104002"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=104002"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"