Malicious Rust crate Arrayref runs a build-time payload

Re:Malicious Rust crate Arrayref runs a build-time payload by neutronicus on Thursday August 20, 2026 @11:02AM (#49375645)

The "npm-ness" of Cargo (centralized and standardized dependency management used at every opportunity) is generally pitched as one of the primary developer experience advantages over C++.

[ Parent | on HN ]

Re:Malicious Rust crate Arrayref runs a build-time payload by pjmlp on Thursday August 20, 2026 @02:36PM (#49378426)

For those missing the npm like experience in C, they can use apt, yum, dnf, winget, nuget, conan, vcpkg.

[ Parent | on HN ]

Re:Malicious Rust crate Arrayref runs a build-time payload by kibwen on Friday August 21, 2026 @03:16AM (#49384849)

In a large enough C codebase, you may even find yourself somehow using all of these simultaneously. :)

[ Parent | on HN ]

Re:Malicious Rust crate Arrayref runs a build-time payload by pjmlp on Sunday August 23, 2026 @08:05AM (#49408139)

Yep.

[ Parent | on HN ]

Re:Malicious Rust crate Arrayref runs a build-time payload by tsimionescu on Thursday August 27, 2026 @06:34AM (#49462559)

The thing is, just having a centralized standardized dependency manager doesn't in itself force your ecosystem into this dangerous "micro dependency" pattern. Java'd Maven is also a centralized standardized dependency manager, as is Python's PyPI. However, neither the Java nor the Python ecosystem have devolved into having dependency libraries with 4 methods in them becoming used and required by major libraries.

[ Parent | on HN ]