GitHub Actions leaking secrets when Miri output is cached
Rust's Miri tool stored all environment variables into target/, letting GitHub PR CI runs read cached secrets; fix ships in nightly 2026-09-22.
30
Organization
Rust Security Response Team
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenAug 25, 2026
- Last mentionedSep 22, 2026
Timeline
2 articles · newest firstRust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
Compromised maintainer account published malicious versions of popular Rust crates with 245M downloads, delivering a build-time payload via typosquatted proc-macro1 dependency.
82
Appears with
- Wizvendor · 1
- Miriorganization · 1
- append-only-vecproduct · 1
- OpenAIorganization · 1
- Rust developersvictim · 1
- proc-macro1product · 1
- GitHub Actionsorganization · 1
- internmentproduct · 1
- crates.iovendor · 1
- Rustvendor · 1
- Nextron Systemsvendor · 1
- rust-setup implantmalware · 1
- arrayrefproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.