V\u00fdvoj\u00e1ri jazyka Rust varovali pred odhalen\u00edm bal\u00edka rustdecimal s malv\u00e9rom v repozit\u00e1ri crates.io. Bal\u00edk bol zalo\u017een\u00fd na legit\u00edmnom bal\u00edku rust_decimal a vyu\u017e\u00edval podobnosti v n\u00e1zve (typov\u00fd skript) s predpokladom, \u017ee si pou\u017e\u00edvate\u013e nev\u0161imne ch\u00fdbaj\u00faci podtr\u017en\u00edk pri vyh\u013ead\u00e1van\u00ed alebo v\u00fdbere modulu zo zoznamu. <\/p>\n
Zauj\u00edmav\u00e9 je, \u017ee uveden\u00e1 strat\u00e9gia bola \u00faspe\u0161n\u00e1 a pod\u013ea po\u010dtu stiahnut\u00ed falo\u0161n\u00fd bal\u00edk len mierne zaost\u00e1val za p\u00f4vodn\u00fdm (~111 tis\u00edc stiahnut\u00ed rustdecimal 1.23.1 a 113 tis\u00edc p\u00f4vodn\u00e9ho rust_decimal 1.23.1). V\u00e4\u010d\u0161ina stiahnut\u00ed sa pritom t\u00fdkala ne\u0161kodnej k\u00f3pie, ktor\u00e1 neobsahovala malv\u00e9r. Malv\u00e9rov\u00e9 zmeny boli pridan\u00e9 25. marca vo verzii rustdecimal 1.23.5, ktor\u00e1 bola pred odhalen\u00edm probl\u00e9mu a zablokovan\u00edm bal\u00edka stiahnut\u00e1 pribli\u017ene 500-kr\u00e1t (predpoklad\u00e1 sa, \u017ee v\u00e4\u010d\u0161ina stiahnut\u00ed malv\u00e9r verzie bola vykonan\u00e1 botmi) a nebola pou\u017eit\u00e1 v z\u00e1vislostiach in\u00fdch bal\u00edkov pr\u00edtomn\u00fdch v repozit\u00e1ri (nie je vyl\u00fa\u010den\u00e9, \u017ee malv\u00e9rov\u00fd bal\u00edk bol v z\u00e1vislostiach koncov\u00fdch aplik\u00e1ci\u00ed). <\/p>\n
Malv\u00e9rov\u00e9 zmeny spo\u010d\u00edvali v prid\u00e1n\u00ed novej funkcie Decimal::new, ktor\u00e9ho implement\u00e1cia obsahovala obfuskovan\u00fd k\u00f3d na na\u010d\u00edtanie z extern\u00e9ho servera<\/a> a spustenie spustite\u013en\u00e9ho s\u00faboru. Pri zavolan\u00ed funkcie sa vykonala kontrola premennej prostredia GITLAB_CI, v pr\u00edpade nastavenia ktorej sa z extern\u00e9ho servera na\u010d\u00edtal s\u00fabor \/tmp\/git-updater.bin. Na\u010d\u00edtan\u00fd malv\u00e9rov\u00fd modul podporoval pr\u00e1cu v Linuxe a macOS (platforma Windows nebola podporovan\u00e1). <\/p>\n Predpokladalo sa, \u017ee malv\u00e9rov\u00e1 funkcia bude vykonan\u00e1 po\u010das testovania na syst\u00e9moch kontinu\u00e1lnej integr\u00e1cie. Po zablokovan\u00ed rustdecimal administr\u00e1tori crates.io vykonali anal\u00fdzu obsahu repozit\u00e1ra na pr\u00edtomnos\u0165 podobn\u00fdch malv\u00e9rov\u00fdch vlo\u017eiek, ale nena\u0161li \u017eiadne probl\u00e9my v in\u00fdch bal\u00edkoch. Majite\u013eom syst\u00e9mov kontinu\u00e1lnej integr\u00e1cie zalo\u017een\u00fdch na platforme GitLab sa odpor\u00fa\u010da uisti\u0165 sa, \u017ee testovan\u00e9 serveroch<\/a> projekty nepou\u017e\u00edvali v z\u00e1vislostiach bal\u00edk rustdecimal. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u044f\u0437\u044b\u043a\u0430 Rust \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 crates.io \u043f\u0430\u043a\u0435\u0442\u0430 rustdecimal, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u041f\u0430\u043a\u0435\u0442 \u0431\u044b\u043b \u043e\u0441\u043d\u043e\u0432\u0430\u043d \u043d\u0430 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 rust_decimal \u0438 \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0441\u0445\u043e\u0434\u0441\u0442\u0432\u043e\u043c \u0432 \u0438\u043c\u0435\u043d\u0438 (\u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433) \u0441 \u0440\u0430\u0441\u0447\u0451\u0442\u043e\u043c \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043d\u0435 \u043e\u0431\u0440\u0430\u0442\u0438\u0442 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u0430 \u043f\u043e\u0434\u0447\u0451\u0440\u043a\u0438\u0432\u0430\u043d\u0438\u044f, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u044f \u043f\u043e\u0438\u0441\u043a \u0438\u043b\u0438 \u0432\u044b\u0431\u0438\u0440\u0430\u044f \u043c\u043e\u0434\u0443\u043b\u044c \u0438\u0437 \u0441\u043f\u0438\u0441\u043a\u0430. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u0430\u044f \u0441\u0442\u0440\u0430\u0442\u0435\u0433\u0438\u044f \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104002","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47V Rust-repozit\u00e1ri crates.io bol odhalen\u00fd malv\u00e9r bal\u00edk rustdecimal | ProHoster","description":"V\u00fdvoj\u00e1ri jazyka Rust varovali pred odhalen\u00edm bal\u00edka rustdecimal s malv\u00e9rom v repozit\u00e1ri crates.io.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-rust-repozitorii-crates-io-vyyavlen-vredonosnyj-paket-rustdecimal","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Rust-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 crates.io \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043f\u0430\u043a\u0435\u0442 rustdecimal | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u044f\u0437\u044b\u043a\u0430 Rust \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 crates.io \u043f\u0430\u043a\u0435\u0442\u0430 rustdecimal, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-rust-repozitorii-crates-io-vyyavlen-vredonosnyj-paket-rustdecimal","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-05-11T07:36:37+00:00","article:modified_time":"2022-05-11T07:36:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104002","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 16:03:02","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-05-11 07:37:47","updated":"2026-02-22 16:03:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/104002","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=104002"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/104002\/revisions"}],"predecessor-version":[{"id":164415,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/104002\/revisions\/164415"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=104002"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=104002"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=104002"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"