RUSTBOT, THE MACOS MALWARE USED IN THE LATEST RUST SUPPLY CHAIN ATTACK

Summary from the TLDR InfoSec newsletter

Poisoned crates.io releases of arrayref, internment, and append-only-vec pulled in a malicious build-time dependency that fetched an arm64 Mach-O implant during cargo build, harvesting ~/.aws, ~/.ssh, and ~/.kube credentials before its RSA tasking channel was neutered by the private key shipping inside the binary.