News for hackers. Stuff that matters.

A comment on Malicious Rust crate Arrayref runs a build-time payload. Parent comment

Re:Malicious Rust crate Arrayref runs a build-time payload by Aeolos on Thursday August 20, 2026 @10:36AM (#49375201)
The problem is that build scripts run automatically without user consent or intevention.

`cargo add` is sufficient to compromise you, before you have a chance to even vet the code.

[ Parent | on HN ]
Re:Malicious Rust crate Arrayref runs a build-time payload by kibwen on Thursday August 20, 2026 @03:23PM (#49378978)
`cargo add` just modifies your Cargo.toml, it doesn't build anything.
[ Parent | on HN ]
Re:Malicious Rust crate Arrayref runs a build-time payload by xdavidliu on Friday August 21, 2026 @09:14AM (#49387594)
https://shnatsel.medium.com/do-not-run-any-cargo-commands-on...

> any command starting with cargo can run arbitrary code when operating on an untrusted repository, and should be treated the same as cargo run.

[ Parent | on HN ]
Re:Malicious Rust crate Arrayref runs a build-time payload by kibwen on Sunday August 23, 2026 @12:08AM (#49405986)
This comment is both true and entirely irrelevant. The context of this subthread is not running a Cargo command in a checkout of a malicious git repo, it's alleging that `cargo add foo` runs the build script of the crate `foo`, which is false.
[ Parent | on HN ]