News for hackers. Stuff that matters.
Re:Malicious Rust crate Arrayref runs a build-time payload by tsimionescu on Thursday August 20, 2026 @05:46PM (#49380703)
The horrible practice is not writing libraries, it's having individual small packages like this crate that are handled by individual small authors, and ending up with huge webs of small dependencies.

The better practice is for bigger projects to form collecting such small utilities into larger utility libraries that have some organization, security practices, code reviews, etc. Good examples are Java's Apache Commons or C++'s Boost.

Re:Malicious Rust crate Arrayref runs a build-time payload by vablings on Friday August 21, 2026 @10:05AM (#49388275)
Both the examples you provided fit into the first scenario described. See libs by dtolnay for useful tools