News for hackers. Stuff that matters.

A comment on Malicious Rust crate Arrayref runs a build-time payload. Parent comment

Re:Malicious Rust crate Arrayref runs a build-time payload by jeroenhd on Friday August 21, 2026 @04:45AM (#49385462)
All of those can (and some do) wget source code from the internet and run it if you kick off their build pipeline. People just tend to use these tools differently.

Nothing is preventing anyone from distributing Rust crates as standard system packages, like some distros do with Python.

I think Debian is actually shipping rust libs in their repositories: https://wiki.debian.org/Rust Now Rust developers can also enjoy having to deal with popular packages that are years out of date/missing from popular repositories/getting deleted.

[ Parent | on HN ]
Re:Malicious Rust crate Arrayref runs a build-time payload by account42 on Friday August 21, 2026 @04:54AM (#49385527)
Of course they can be made to do anything but that's not what they are designed for and as a result they also build a culture that frowns upon doing that. Debian and other Linux distributions would have never had the policy do handle dependency resolution themselves if contemporary build systems automatically fetched everything automatically rather than being designed to use dependencies provided by the user.
[ Parent | on HN ]