Utvecklarna av spr\u00e5ket Rust har varnat f\u00f6r att det har uppt\u00e4ckts ett paket rustdecimal i f\u00f6rvaret crates.io som inneh\u00e5ller skadlig kod. Paketet grundades p\u00e5 det legitima paketet rust_decimal och anv\u00e4nde en liknande namnstruktur (typsnyting) med f\u00f6rhoppningen att anv\u00e4ndaren skulle ignorera avsaknaden av understreck n\u00e4r denne s\u00f6kte eller valde ett modul fr\u00e5n listan. <\/p>\n
Det \u00e4r v\u00e4rt att notera att den angivna strategin har visat sig framg\u00e5ngsrik, och det falska paketet har endast legat n\u00e5got efter originalet i nedladdningar (~111 000 nedladdningar av rustdecimal 1.23.1 och 113 000 av originalet rust_decimal 1.23.1). Det var dock n\u00e4stan alla nedladdningar som gjordes av den ofarliga klonen, som inte inneh\u00f6ll skadlig kod. Skadliga \u00e4ndringar lades till den 25 mars i versionen rustdecimal 1.23.5, som innan problemet uppt\u00e4cktes och paketet blockerades hade laddats ner cirka 500 g\u00e5nger (det antas att en stor del av nedladdningarna av den skadliga versionen genomf\u00f6rdes av robotar) och inte anv\u00e4ndes i beroenden av andra paket som finns i f\u00f6rvaret (det \u00e4r m\u00f6jligt att det skadliga paketet var en del av beroenden f\u00f6r slutapplikationer). <\/p>\n
De skadliga \u00e4ndringarna bestod i att en ny funktion Decimal::new lades till, i vars implementering skadlig kod fanns f\u00f6r att ladda ner fr\u00e5n en extern servern<\/a> och k\u00f6ra en k\u00f6rbar fil. N\u00e4r funktionen anropades utf\u00f6rdes en kontroll av milj\u00f6variabeln GITLAB_CI, d\u00e4r, om den var aktiv, laddades en fil fr\u00e5n en extern server ner till \/tmp\/git-updater.bin. Den nedladdade skadliga hanteraren st\u00f6dde drift i Linux och macOS (Windows-plattformen st\u00f6ddes inte). <\/p>\n Det antogs att den skadliga funktionen skulle k\u00f6ras under testning p\u00e5 system f\u00f6r kontinuerlig integration. Efter blockeringen av rustdecimal genomf\u00f6rde administrat\u00f6rerna av crates.io en analys av inneh\u00e5llet i f\u00f6rvaret f\u00f6r att uppt\u00e4cka liknande skadliga inslag men hittade inga problem i andra paket. \u00c4gare av system f\u00f6r kontinuerlig integration baserade p\u00e5 GitLab-plattformen rekommenderas att s\u00e4kerst\u00e4lla att de projekt de testar inte har rustdecimal som beroende. servrar<\/a> Utvecklarna av spr\u00e5ket Rust har varnat f\u00f6r att det har uppt\u00e4ckts ett paket rustdecimal i f\u00f6rvaret crates.io som inneh\u00e5ller skadlig kod. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u044f\u0437\u044b\u043a\u0430 Rust \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 crates.io \u043f\u0430\u043a\u0435\u0442\u0430 rustdecimal, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u041f\u0430\u043a\u0435\u0442 \u0431\u044b\u043b \u043e\u0441\u043d\u043e\u0432\u0430\u043d \u043d\u0430 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 rust_decimal \u0438 \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0441\u0445\u043e\u0434\u0441\u0442\u0432\u043e\u043c \u0432 \u0438\u043c\u0435\u043d\u0438 (\u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433) \u0441 \u0440\u0430\u0441\u0447\u0451\u0442\u043e\u043c \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043d\u0435 \u043e\u0431\u0440\u0430\u0442\u0438\u0442 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u0430 \u043f\u043e\u0434\u0447\u0451\u0440\u043a\u0438\u0432\u0430\u043d\u0438\u044f, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u044f \u043f\u043e\u0438\u0441\u043a \u0438\u043b\u0438 \u0432\u044b\u0431\u0438\u0440\u0430\u044f \u043c\u043e\u0434\u0443\u043b\u044c \u0438\u0437 \u0441\u043f\u0438\u0441\u043a\u0430. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u0430\u044f \u0441\u0442\u0440\u0430\u0442\u0435\u0433\u0438\u044f \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104002","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ett skadligt paket rustdecimal har uppt\u00e4ckts i Rust-f\u00f6rr\u00e5det crates.io | ProHoster","description":"\ud83e\udd47Ett skadligt paket rustdecimal har uppt\u00e4ckts i Rust-f\u00f6rr\u00e5det crates.io | ProHoster","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/v-rust-repozitorii-crates-io-vyyavlen-vredonosnyj-paket-rustdecimal","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Rust-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 crates.io \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043f\u0430\u043a\u0435\u0442 rustdecimal | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u044f\u0437\u044b\u043a\u0430 Rust \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 crates.io \u043f\u0430\u043a\u0435\u0442\u0430 rustdecimal, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/v-rust-repozitorii-crates-io-vyyavlen-vredonosnyj-paket-rustdecimal","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-05-11T07:36:37+00:00","article:modified_time":"2022-05-11T07:36:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104002","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 16:03:02","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-05-11 07:37:47","updated":"2026-02-22 16:03:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/104002","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=104002"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/104002\/revisions"}],"predecessor-version":[{"id":164415,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/104002\/revisions\/164415"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=104002"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=104002"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=104002"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"