r/programming • u/Successful_Bowl2564 • 12d ago

Supply chain attack on arrayref

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
191 Upvotes

97% Upvoted

65 comments sorted by

View all comments

34

u/NotSoNewell 12d ago

Huh, I just realized I don't even know how to git diff the updated Cargo packages even if I wanted to.

15

u/siera7879 12d ago edited 12d ago

There are tools to audit code and define chains of trust that allow to do that : cargo-vet and cargo-crev

And even if a lot of packages and updates are not audited, I feel like rust currently has the best tools for source code auditing, since I couldn’t find maintained tools for other languages ecosystems =/

2

u/TankorSmash 12d ago

Doesn't npm just have the diff between the lock files built in?

1

u/siera7879 12d ago

Npm diff ? From what I see it can show the update diff, but I don’t see a npm tool that allows to write and import code reviews and chains of trust. As reading every diff is very tedious, it would be better to mutualize the work.