this post was submitted on 20 Aug 2026
88 points (100.0% liked)

Rust

8237 readers
24 users here now

Welcome to the Rust community! This is a place to discuss about the Rust programming language.

Wormhole

!performance@programming.dev

Credits

  • The icon is a modified version of the official rust logo (changing the colors to a gradient and black background)

founded 3 years ago
MODERATORS
snowe@programming.dev
Ategon@programming.dev
EdTheLegendary@programming.dev
torcherist@programming.dev
88
Supply chain attack on arrayref (blog.rust-lang.org)
submitted 2 days ago by Gobbel2000@programming.dev to c/rust@programming.dev
22 comments fedilink hide all child comments
 

If you recently used Cargo, make sure your system didn't get infected. Here is another article with a little more info: https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack

you are viewing a single comment's thread
view the rest of the comments
[โ€“] FizzyOrange@programming.dev 3 points 1 day ago (1 children)

That would be good but it's not a magic solution to this problem. They would just move the exploit to runtime. Yeay you don't get hacked if you compile and never run your program.

You can counter that there are some situations where the program is run sandboxed, e.g. if you're compiling to WASI or microcontroller firmware or whatever. But those are a tiny minority of cases.

[โ€“] Mihies@programming.dev 4 points 1 day ago

Good point. But hey, at least CI would be safer if nothing else and we'd raise the bar.