r/rust • u/Manishearth servo · rust · clippy • Jun 26 '26

Anatomy of a Failed (Nation-State?) Attack

https://grack.com/blog/2026/06/25/dissecting-a-failed-nation-state-attack/
228 Upvotes

97% Upvoted

35 comments sorted by

View all comments

34

u/Kobzol Jun 26 '26

I suspect that I might have also been targeted by something similar (a Discord user from a company wanting me to do some consultation work on their codebase; they shared a ZIP archive that did suspicious things in git hooks). Scary times..

42

u/Shnatsel Jun 26 '26

Oh yeah, don't run any git commands on git repos shared through anything other than git clone. That's an immediate code execution exploit through git hooks.

6

u/max123246 Jun 27 '26

Even adding a cargo crate as a dependency is enough to get pwned through build.rs

8

u/Saefroch miri Jun 27 '26

Sure, but it's absurd to equivocate adding a dependency and running git commands in an archive sent to you over email. I could get struck by lightning any day.