Malicious Rust crate Arrayref runs a build-time payload

Re:Malicious Rust crate Arrayref runs a build-time payload by bryanlarsen on Thursday August 20, 2026 @01:39PM (#49377733)

I expected somebody to pull out an example "disproving" my point. It wouldn't be hard. I can point out rust projects that have a ton of external dependencies, and then point at similar projects with very few.

But a Python example doesn't really count, in my mind -- Python is pre-GitHub so tends to have small numbers of large external dependencies, like C++ and other older languages.

[ Parent | on HN ]

Re:Malicious Rust crate Arrayref runs a build-time payload by QuadmasterXLII on Thursday August 20, 2026 @01:56PM (#49377940)

If a python example doesn't count, why were your two example languages python and go?

But yeah, small number of large dependencies is the way to go.

[ Parent | on HN ]

Re:Malicious Rust crate Arrayref runs a build-time payload by bryanlarsen on Thursday August 20, 2026 @07:50PM (#49381873)

Replying to the sentence "The dependency tree of comparable Go and Rust projects seem comparable, IMO." with a Python example seems pretty odd.

[ Parent | on HN ]