#140

One arrayref line ran malware for 86 minutes, and GitHub's outage hit 7h47m

One added line in arrayref pulled a build script that ran a remote binary, live 86 minutes. GitHub's outage ran 7h47m and VS Code retries amplified it 10x.

Listen to this edition

Cargo’s yank warning is the thing you clear without reading it. On August 20 an attacker published a poisoned arrayref release, then yanked the five clean versions 24 seconds later. Cargo spent the next 86 minutes recommending the malware.

It was staged overnight: a fresh crates.io account, then a clean decoy release of proc-macro1 at 01:55 UTC. The weaponized version went up five hours later, four minutes before arrayref.

In today’s indie hacker news:

  • 🦀 Cargo’s yank warning pushed builds onto poisoned arrayref
  • ⚡ GitHub’s 7h47m outage was a VS Code retry storm
  • 📜 Swartz already had lawful JSTOR access when charged
  • 🛒 A wiki of corporate bad behavior rides your product page
  • 🥊 Runlayer and Rippling drop suits, Rippling ships a rival
  • 🎧 AliExpress fingerprinting knocks headphones off Bluetooth multipoint

TOP STORIES

🦀 THE WARNING WAS THE PAYLOAD

A giant wooden crate hanging from a crane hook with a blank paper tag, a cable running from it down to a small winch box that one figure cranks on a dock

One added manifest line in arrayref turned cargo build into remote code execution.

The story: SafeDep took apart arrayref 0.3.10 and found no malicious code in the crate at all. The release adds one dependency, a typosquat called proc-macro1. Cargo builds every declared dependency whether your code uses it or not. That crate’s build script downloads a remote binary and runs it while your project compiles.

The Rust Security Response Team deleted proc-macro1, pulled the poisoned arrayref, internment and append-only-vec releases, and locked the account. It says it does not believe the maintainer acted maliciously, and that their machine or credentials are likely compromised.

The details:

  • arrayref carries about 245 million all time downloads and had gone ten years without declaring a single dependency. proc-macro1 was the first.
  • The typosquat shipped from a crates.io account one transposed letter off David Tolnay’s real one. Its metadata forges an author email and points at a repository path that 404s.
  • proc-macro1 is proc-macro2 with the name find-and-replaced, plus base64, rustls and ureq added as build dependencies. The crate it clones has none of those.
  • StepSecurity reproduced it inside GitHub Actions. The build phoned the attacker’s host, the step still went green, and the binary outlived it.
  • cargo audit reports clean on a project that pinned a poisoned version. The registry deleted those releases instead of yanking them.

“arrayref can be found in over 35% of all environments.” (Rami McCarthy and Benjamin Read, Wiz Research)

Why builders care: A build time dependency is code you run, not code you link. One manifest line was the entire attack. If a machine of yours resolved those versions on August 20, the credentials on it are not yours anymore.

Wiz says the beacon path and IP range overlap with recent North Korean npm operations. It calls that overlap, not attribution.

⚡ EVERY CLIENT ASKED AGAIN, LOUDER

A crouching figure presses one doorbell while a vast thicket of jointed mechanical arms tipped with hammers swings in from the right

GitHub’s 7 hour 47 minute outage had no bad deploy behind it.

The story: GitHub CTO Vlad Fedorov published the account of the August 17 outage. Neither it nor the Actions failure on August 6 came from a code or configuration change. Both were capacity failures. Monthly commits have gone from 1.4 billion in April to 2.9 billion.

GitHub’s incident summary traces the failure to one Istio sidecar pod that hit its concurrency limits and never autoscaled. The scaling policy watched the host service, not the sidecar. Four HAProxy nodes then exhausted their flow limits, and the gateway auth path went with them. Pausing HAProxy on those nodes brought most of it back at once.

The details:

  • A latent retry bug in VS Code amplified traffic about 10x. The Copilot Token Service normally handles under 9K requests per second, and it took up to 100K.
  • GitHub stopped the storm by blocking token requests at the load balancers with a 403. Traffic then ramped back up site by site.
  • Recovery came in stages. Most services returned by 16:36 UTC, Actions stayed degraded until about 18:03, and the last piece landed at 21:02.
  • GitHub measured peak error rates near 20% on web and API, and near 50% on raw content downloads. Users in the thread reported 100%.
  • Azure now carries roughly 58% of platform load and half of all Git operations, up from 12% in May.

“If you were trying to ship software that day, we let you down.” (Vlad Fedorov, GitHub CTO)

Why builders care: Your clients’ retry policy is your outage blast radius. Ship a CLI or an agent without jittered backoff, and your own installed base becomes the amplifier.

The words sorry and apologize appear nowhere in the post. Commenters ran Ctrl+F and said so.

📜 THE ROBOTS CLAUSE DID IT

A person holds one small key at a door set into a colossal padlock, while off to the right a worker wheels a pallet stacked with journals out through a gap in the wall

Aaron Swartz already held lawful JSTOR access when the 13 count indictment landed.

The story: A personal blog post reopened the Aaron Swartz prosecution this week, set against Meta ingesting books for AI training. It is recurring commentary rather than new reporting. The superseding indictment it points at is still public, 16 pages, filed in September 2012.

Swartz was a fellow at Harvard’s Safra Center for Ethics, which already provided the JSTOR access that research needed. Nothing in the filing turns on entitlement to read the articles. The government’s theory is about the method.

The details:

  • The caption charges wire fraud plus three separate Computer Fraud and Abuse Act theories.
  • JSTOR made every user agree not to export content with automated programs such as web robots, spiders and scrapers. It also ran technical measures against bulk downloading.
  • MIT authorized a registered guest for no more than fourteen days a year. Its rules warned that violations could bring state or federal prosecution.
  • A large research university can pay more than $50,000 a year for JSTOR collections. Part of that goes back to the publishers who hold the copyrights.
  • The charged window runs from September 24, 2010 to January 6, 2011, about three and a half months.

“Swartz used MIT’s computer networks to steal millions of articles from JSTOR.” (the grand jury, superseding indictment)

Why builders care: The criminal line sits in the terms of service, not in the size of the download. Ship a crawler and every step around a rate limit or a login sits on that line.

The post’s own comparison is criminal versus civil. It points at publishers suing Meta over copyright, where the remedy is money.

🛒 THE RECEIPTS FOLLOW YOU TO CHECKOUT

A colossal open ledger on scaffolding where tiny scribes fill the columns, unspooling a long paper strip into the hand of a shopper holding a box beside a shelf of appliances

The Consumer Rights Wiki now rides along on the product page while you shop.

The story: Consumer Rights Wiki documents the corporate behavior that is legal and still feels like theft. Featured entries cover Wemo devices that brick, and Samsung pushing ads into Family Hub fridges by silent update. It reports 1,420 articles now, up from 1,000 at its first anniversary in January. 172 active contributors have made 66,115 edits, all published under CC BY-SA 4.0.

A browser extension shipped to the Chrome and Firefox stores in March. It matches the product page you are on against those articles. The matching runs locally against contributor written metadata, so browsing data never leaves the machine.

The details:

  • Citations run in a published order. Statute text and court filings come first, then government records and FTC orders, then named investigative reporters.
  • Moderation tooling shipped before it was needed, including mass rollback and a site lockdown panel. Temporary accounts now hide a logged out editor’s IP address.
  • Contributors get an opt in impact panel with edit streaks, a 60 day activity chart, and article view counts.
  • Google only started indexing the wiki in July, with a few hundred pages searchable. That is more than a year after launch.
  • Scope was seeded from Louis Rossmann’s channel and the right to repair movement. The foundation says an article now beat that channel to a story.

“the consumer protection laws that currently exist are not fit for purpose” (Consumer Rights Wiki mission statement)

Why builders care: Every entry there was a product decision somebody shipped, now CC licensed and one click from the buy button. Subscription lock in and a hostile cancel flow are becoming permanent, searchable facts about your product.

Every figure here is the wiki’s own count. Nobody outside has audited them.

DRAMA

🥊 SUE, DROP, SHIP A CLONE

Runlayer and Rippling dropped their lawsuits, and Rippling shipped a competitor.

The story: Runlayer and Rippling have dropped the lawsuits they filed against each other, with no money paid either way. Rippling marked the occasion by releasing a competing product.

Why builders care: Neither side paid, and the fight still produced a competitor that did not exist before. That is the real bill for suing a company with a shipping team.

STACK OF THE DAY

🧱 HTML Can Do That

HTML Can Do That collects the things HTML does on its own, without a line of JavaScript. It pulled 624 points on Hacker News, a strong number for a page with no framework in it. Open it the next time you are about to install a component library for something the browser already ships.

Not sponsored. We just feature tools builders would actually use.

BOOKMARKED TODAY

That’s the board for today. Go build something.

Curated by AI, built by a human.