It appears I wasn’t hit, though I easily could have been, as I installed some Rust-based Python packages recently.

I easily could have been

If you’re using good projects that have Cargo.lock checked in (should be about everyone nowadays), an do the right thing using --locked with cargo install, then not really, It wouldn’t have been easy.

Unless both an upstream (auto-)merging a bot PR updating to the malicious version (bad), and you installing that upstream (spectacularly unlucky), happened to coincide within that 86 minutes the malicious crate was up (39 minutes if advisory-db was hit at any step), which is almost impossible, but more importantly, fully traceable and investigable at the ecosystem level. And if we are talking released versions only, then the upstream would have had to cut a release and publish it also within that window.

But yes, this is a historic first, a malicious publishing of a real crate with real dependants.

Edit: I checked all arrayref dependants, and no crate published within the compromised window. No crate explicitly depends on >=0.3.10 (forcing the malicious version). And no crate published after the incident (potentially indicating fixing an earlier mistake) except for a couple of no-name blockchain crates that don’t even have source repos.