r/programming • u/Successful_Bowl2564 • 12d ago

Supply chain attack on arrayref

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
189 Upvotes

97% Upvoted

65 comments sorted by

View all comments

119

u/piesou 12d ago edited 12d ago

Was only a question of time. Rust has the same mindset as Node/NPM.

PS: for the screaming crowd: yes, anyone can get supply chain attacked. HOWEVER:

  • If you have a proper stdlib, chances are, you don't have a lot of dependencies
  • If you have less dependencies, the chance of supply chain attacks drops significantly
  • If you have well established dependencies like Spring, their security practices are very likely better than a rando off the internet

What does that mean for Rust? They don't need to just work on the language, they need to provide a larger ecosystem as well. How they do it is up to them.

0

u/Sigmatics 12d ago

But what is the attack vector here? I'm not aware of any postinstall scripts for rust crates?

36

u/GuybrushThreepwo0d 12d ago

Rust has a build.rs file that runs at compile time 

3

u/syklemil 12d ago

It also has flags like --offline, and --frozen, which means --locked --offline, so it's possible to nerf at least simple "download & execute something in the build file" attacks, though like the other commenter says, the programmer's editor may be set up to run the offending code.

16

u/paholg 12d ago

Build scripts and proc macros are both RCE at editor open time.

But that doesn't really matter, because most people also run the code.

7

u/piesou 12d ago

So there's this concept called code that runs when you execute it. No postinstall scripts needed

2

u/Sigmatics 12d ago

Of course, but there's a difference in getting owned instantly on install and having to execute something first. Namely that in theory you have time to inspect the package first.

But as others have said, the build.rs basically owns you at installation time