Package Management 周报 09-19：Rust 社工攻防、YARD 文档生成执行边界、Podman/CVE-2025-11395
- ID: 2752105c
- 原文链接: https://nesbitt.io/2026/09/19/this-week-in-package-management.html
- 作者: Andrew Nesbitt
- 日期: 2026-09-19
- 分类: infra
- 来源类型: article
- 标签: supply-chain, package-management, rust, rubygems, podman
- 质量评分: 4/5
- 抓取时间: 2026-09-19T22:35:00Z
中文导读
Andrew Nesbitt 包管理器周报本期以供应链安全为主轴：Rust 团队官方警告“针对 rust-lang team 及热门 crate 维护者的社工攻防”，攻击者以招聘/项目/合作为由头约视频面试，诱使目标安装“音频编解码器”或执行剪贴板里的命令，以优质账号后续发布恶意 crate；Aaron Patterson 本人拆解 5 月 rubygems.org spam 事件：攻击者将 --load ./script.rb 塞进 gem 的 .yardopts，YARD 文档生成阶段直接执行，在 rubygems.info 容器内获得 cached API key、随后批量发布恶意 gem。其他实操：Podman 6.1.2/5.8.7 修 CVE-2025-11395（podman load 加载构造 layer tarball 可覆盖宿主机文件）；pnpm 12.4.2 修了 POSIX shim 重定向各包可执行文件的问题；uv 0.12.17 引入 preview minimum-libc-version，pylock.toml 里 wheel 名/版本不一致直接拒绝。判断：“文档生成也是执行边界”从理论变为实证。
为什么值得关注
Nesbitt 包管周报：Rust 社工攻防 + rubygems “文档生成也是执行边界”实证
关键信息
- 标题：Package Management 周报 09-19：Rust 社工攻防、YARD 文档生成执行边界、Podman/CVE-2025-11395
- URL：https://nesbitt.io/2026/09/19/this-week-in-package-management.html
- 发布时间：2026-09-19
- 分类：infra
- 标签：supply-chain, package-management, rust, rubygems, podman
English Summary
Andrew Nesbitt's package-management weekly leads with supply-chain security. Rust team issued an official warning about a social-engineering campaign targeting rust-lang team members and popular crate maintainers: video calls framed as jobs/projects coerce the victim into installing an 'audio codec' or running a clipboard command, which later publishes malicious crates from a compromised account. Aaron Patterson walked through the May rubygems.org spam: --load ./script.rb was embedded in a gem's .yardopts, so YARD documentation generation executed arbitrary code inside rubygems.info containers and harvested cached API keys, enabling batched malicious gem publishing. Other items: Podman 6.1.2 / 5.8.7 fix CVE-2025-11395 (podman load on crafted layer tarballs can overwrite host files); pnpm 12.4.2 closes a POSIX shim redirection flaw affecting dependencies' executables (Cygwin/MSYS2/WSL shims still affected on PATH); uv 0.12.17 ships preview minimum-libc-version, which rejects mismatched wheel names in pylock.toml. Verdict: 'doc generation is an execution boundary' just became an empirical fact.