Malicious Rust crate Arrayref runs a build-time payload

Re:Malicious Rust crate Arrayref runs a build-time payload by vablings on Thursday August 20, 2026 @10:30AM (#49375102)

There are two reasons you might want to use a crate, The first being that you want to use a good solid implementation that you know someone has spent more time doing and works better than almost any solution you could integrate. The second is you don't want to spend time implementing that.

Writing macros in rust is a pretty horrible experience but it's not difficult

[ Parent | on HN ]

Re:Malicious Rust crate Arrayref runs a build-time payload by tsimionescu on Thursday August 20, 2026 @05:46PM (#49380703)

The horrible practice is not writing libraries, it's having individual small packages like this crate that are handled by individual small authors, and ending up with huge webs of small dependencies.

The better practice is for bigger projects to form collecting such small utilities into larger utility libraries that have some organization, security practices, code reviews, etc. Good examples are Java's Apache Commons or C++'s Boost.

[ Parent | on HN ]

Re:Malicious Rust crate Arrayref runs a build-time payload by vablings on Friday August 21, 2026 @10:05AM (#49388275)

Both the examples you provided fit into the first scenario described. See libs by dtolnay for useful tools

[ Parent | on HN ]