@rust I appreciate the work put into this response. Would be useful to have the datetime that the compromised releases were made. I'm currently assuming it happened today but that's not clear from the post.
2
Replies
8
Boosts
@rust I appreciate the work put into this response. Would be useful to have the datetime that the compromised releases were made. I'm currently assuming it happened today but that's not clear from the post.
@rukai The malicious dependency (`proc-macro1`) was published today at 07:11 UTC and the malicious version of `arrayref` depending on it was published at 07:15 UTC. We deleted it at 08:03 UTC.
We'll also investigate the publication times of the other affected crates and add this information to the blog post.
