News for hackers. Stuff that matters.

A comment on Malicious Rust crate Arrayref runs a build-time payload. Parent comment

Re:Malicious Rust crate Arrayref runs a build-time payload by ptx on Thursday August 20, 2026 @11:21AM (#49375910)
Why are developers "inherently expected to run untrusted code"? Running untrusted code on developer machines seems like a terrible idea, given that it will compromise everything they build or deploy and (as you mentioned) all their credentials.
[ Parent | on HN ]
Re:Malicious Rust crate Arrayref runs a build-time payload by brazukadev on Thursday August 20, 2026 @05:35PM (#49380592)
because cloning repos and installing dependencies is what developers do daily. 90% of more don't care or even know that doing so they are risking getting hacked.
[ Parent | on HN ]