News for hackers. Stuff that matters.
Re:Self Propagating NPM Malware Compromises over 40 Packages by Klonoar on Tuesday September 16, 2025 @01:16PM (#45265047)
Your typical Rust project does not have over 1000 dependencies.

Zed is not a typical Rust project; it's a full fledged editor that includes a significant array of features and its own homegrown UI framework.

Re:Self Propagating NPM Malware Compromises over 40 Packages by worik on Tuesday September 16, 2025 @05:01PM (#45267992)
What is a "typical Rust project", I wonder?
Re:Self Propagating NPM Malware Compromises over 40 Packages by cesarb on Tuesday September 16, 2025 @06:04PM (#45268783)
One famous example is ripgrep (https://github.com/BurntSushi/ripgrep). Its Cargo.lock (which contains all direct and indirect dependencies) lists 65 dependencies (it has 66 entries, but one of them is for itself).
Re:Self Propagating NPM Malware Compromises over 40 Packages by burntsushi on Tuesday September 16, 2025 @06:32PM (#45269118)
Also, that lock file includes development dependencies and dependencies for opt-in features like PCRE2. A normal `cargo build` will use quite a bit fewer than 65 dependencies.

I would actually say ripgrep is not especially typical here. I put a lot of energy into keeping my dependency tree slim. Many Rust applications have hundreds of dependencies.

We aren't quite at thousands of dependencies yet though.

Re:Self Propagating NPM Malware Compromises over 40 Packages by johnisgood on Wednesday September 17, 2025 @11:35AM (#45277112)
> I would actually say ripgrep is not especially typical here. I put a lot of energy into keeping my dependency tree slim. Many Rust applications have hundreds of dependencies.

Thank you for your honesty, and like you and I said, you put a lot of energy into keeping the dependency tree slim. This is not as common as one would like to believe.

Re:Self Propagating NPM Malware Compromises over 40 Packages by burntsushi on Wednesday September 17, 2025 @11:54AM (#45277366)
I agree it's not common. But neither are Rust applications with 1000+ dependencies. I don't think I've ever compiled a Rust project with over 1,000 dependencies.

Hundreds? Yes, absolutely. That's common.

Re:Self Propagating NPM Malware Compromises over 40 Packages by johnisgood on Wednesday September 17, 2025 @12:11PM (#45277672)
Maybe I am just unlucky enough to always running into Rust projects that pull in over 1000 dependencies. :D

In retrospect, I should have kept a list of these projects. I probably have not deleted these directories though, so I probably still could make a list of some of these projects.

Re:Self Propagating NPM Malware Compromises over 40 Packages by johnisgood on Wednesday September 17, 2025 @11:31AM (#45277060)
Not quite. He is a better developer than most who happen to minimize dependencies, but according to my experiences it is not as common as you would like to believe. Do I really need to make a list of all the Rust projects I have compiled that pulled in over 1000 dependencies? If I need to do it to convince you, I will do so, as my time allows.
Re:Self Propagating NPM Malware Compromises over 40 Packages by wolvesechoes on Wednesday September 17, 2025 @03:51AM (#45273067)
> Zed is not a typical Rust project; it's a full fledged editor

Funny that text editor is being presented here as some kind of behemoth, not representative of typical software written in Rust. I guess typical would be 1234th JSON serialization library.