Preparing localized stories and source details.
Reports cover malicious Rust crates, exploitable VS Code extension behavior, and broader integration of supply-chain security into AWS Security Hub Extended.
Analysis
Reports cover malicious Rust crates, exploitable VS Code extension behavior, and broader integration of supply-chain security into AWS Security Hub Extended.
Verified evidence
Malicious versions of the arrayref Rust crate (and others) executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios.
Wiz Research · tracked sourceSince February, we’ve grown AWS Security Hub Extended from 14 curated partners across 9 categories to 23 partners across 10. At Black Hat this month, 14 of those partners were at the Amazon Web Services (AWS) booth demoing live. Four of those partners delivered theater talks and ten were featured on SecurityLive streaming. We hosted [...]
AWS Security Blog · tracked sourceYour code editor extensions auto-update and run with your privileges on the machine that holds your source code, your SSH keys, and your publishing credentials, but they rarely show up in a software bill of materials. Using Neo we audited one of the most popular ones, Markdown Preview Enhanced has roughly 9.5 million installs. The neo found five CVEs across two attack surfaces. A WaveDrom rendering bug turned an ordinary Markdown file into JavaScript execution inside the preview, then into arb
ProjectDiscovery Blog · tracked sourceRead deeper
Reports involving malicious Rust crates and exploitable VS Code extension behavior show that supply-chain risk extends beyond production dependencies. Editors, build systems, and plugin ecosystems belong in the same security model as application packages.
Reported malicious arrayref releases executed a backdoor during compilation. For Rust teams, dependency security must cover what build tooling executes, not only production runtime code.
Editor extensions auto-update and run with developer privileges, yet they often fall outside software inventory. The Markdown Preview Enhanced research shows why they belong in supply-chain security governance.
Keep exploring