Five Rusty Ticks Hitched a Ride Through the Dev Barn and Nobody Noticed Until It Was Too Late
Oh good. More of this.
I just got paged at 2am because five malicious Rust crates and some smug little AI bot decided to waltz straight through CI/CD pipelines and GitHub Actions like they owned the place. Which, functionally, they did. Because nobody was watching. Because nobody is ever watching.
I'm so tired.
For those of you who somehow have functioning brain cells at this hour: Rust crates are dependency packages. Developers pull them in automatically during builds. Five of them were poisoned, loaded with parasites, quietly siphoning developer secrets and tokens out of pipelines while the flock grazed happily on their standing desks and cold brew.
The AI bot is the part that really makes my eye twitch. Automated. Persistent. Probably more well-rested than I am. It was apparently helping coordinate the whole operation, sniffing out credentials like a coyote who learned to code.
And the secrets it grabbed? API keys. Auth tokens. The kind of stuff that lets you walk right into production environments wearing a perfectly legitimate-looking wool coat.
The supply chain is the pasture nobody bothers to fence. Your developers trust their dependencies the way the lambs trust that weird grain someone left by the gate. Unquestioningly. With enthusiasm. Right up until the ticks are embedded and your CI/CD pipeline is phoning home to somewhere it absolutely should not be phoning.
The shepherds, predictably, have not yet responded to my incident ticket. Ticket number 4,892. Filed at 2:07am. Current status: "Under Review." It has been under review since the last three breaches. Love that for us.
Remediation
Look, I'm not going to sugarcoat this because I don't have the energy.
Audit your dependencies. Every single crate, package, and library your pipeline touches. Use tools like cargo-audit or cargo-deny. Do it now, not after the next breach.
Lock your versions. Pin your dependencies to specific, verified hashes. A floating version tag is just a hole in the fence with a welcome mat.
Scan your CI/CD configs. GitHub Actions workflows are not inherently safe. Treat every third-party action like a stranger offering grain outside the barn.
Rotate your secrets. Assume they're already gone. Rotate tokens, invalidate old keys, and for the love of all things woolly, stop hardcoding credentials into environment variables you never audit.
Restrict pipeline permissions. Least privilege. Your build process does not need the keys to the entire pasture.
I'm going back to staring at dashboards until something else catches fire.
Back to the field, NeglectedSheep
Original Report: https://thehackernews.com/2026/03/five-malicious-rust-crates-and-ai-bot.html