r/programming • u/Successful_Bowl2564 • 12d ago

Supply chain attack on arrayref

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
193 Upvotes

97% Upvoted

65 comments sorted by

View all comments

117

u/piesou 12d ago edited 12d ago

Was only a question of time. Rust has the same mindset as Node/NPM.

PS: for the screaming crowd: yes, anyone can get supply chain attacked. HOWEVER:

  • If you have a proper stdlib, chances are, you don't have a lot of dependencies
  • If you have less dependencies, the chance of supply chain attacks drops significantly
  • If you have well established dependencies like Spring, their security practices are very likely better than a rando off the internet

What does that mean for Rust? They don't need to just work on the language, they need to provide a larger ecosystem as well. How they do it is up to them.

0

u/Sigmatics 12d ago

But what is the attack vector here? I'm not aware of any postinstall scripts for rust crates?

34

u/GuybrushThreepwo0d 12d ago

Rust has a build.rs file that runs at compile time 

3

u/syklemil 12d ago

It also has flags like --offline, and --frozen, which means --locked --offline, so it's possible to nerf at least simple "download & execute something in the build file" attacks, though like the other commenter says, the programmer's editor may be set up to run the offending code.