this post was submitted on 20 Aug 2026
88 points (100.0% liked)

Rust

8239 readers
32 users here now

Welcome to the Rust community! This is a place to discuss about the Rust programming language.

Wormhole

!performance@programming.dev

Credits

  • The icon is a modified version of the official rust logo (changing the colors to a gradient and black background)

founded 3 years ago
MODERATORS
snowe@programming.dev
Ategon@programming.dev
EdTheLegendary@programming.dev
torcherist@programming.dev
88
Supply chain attack on arrayref (blog.rust-lang.org)
submitted 3 days ago by Gobbel2000@programming.dev to c/rust@programming.dev
22 comments fedilink hide all child comments
 

If you recently used Cargo, make sure your system didn't get infected. Here is another article with a little more info: https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack

you are viewing a single comment's thread
view the rest of the comments
[–] TehPers@beehaw.org 5 points 3 days ago

There have been discussions in the past around sandboxing build scripts, but until that day comes (if it does), I think there could at least be a prompt to approve build scripts for individual package versions. Several JS package managers do this now, and it helps.