Malicious Rust crate Arrayref runs a build-time payload
1–10 of 529 posts
Re: Malicious Rust crate Arrayref runs a build-time payload
#2ahh... we now have nodejs ecosystem attack techniques migrating to other systems as well...
Re: Malicious Rust crate Arrayref runs a build-time payload
#3Unfortunately Cargo doesn’t have security controls in place to prevent these kinds of attacks. For example pnpm has controls to allowlist install scripts for dependencies and will warn about new install scripts (without executing them).
There is an open issue for this: https://github.com/rust-lang/cargo/issues/13681
Re: Malicious Rust crate Arrayref runs a build-time payload
#4Why do none of these hijacks embed runtime attacks? It seems like worming the build machines is the goal, rather than compromising downstream users.
It seems like we should be building and testing everything in bubblewrap or some other sandbox going forward.
Re: Malicious Rust crate Arrayref runs a build-time payload
#5Why this still happens? Why after many previous supply-chain attacks maintainers of package repositories still allow anyone uploading packages and pushing updates without security audit?
Re: Malicious Rust crate Arrayref runs a build-time payload
#6Why do none of these hijacks embed runtime attacks? It seems like worming the build machines is the goal, rather than compromising downstream users. It seems like we should be building and testing everything in bubblewrap or some other sandbox going forward.
It usually takes some time for an updated dependency to actually get shipped to users in a release, by which time there's a good chance the attack has been noticed.
Re: Malicious Rust crate Arrayref runs a build-time payload
#7Post on the Rust blog: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on...
Discussion: https://news.ycombinator.com/item?id=49372853
Re: Malicious Rust crate Arrayref runs a build-time payload
#8Thread on the post from main rust blog: https://news.ycombinator.com/item?id=49372853
Direct post link: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on...
Initial report: https://github.com/rustsec/advisory-db/issues/3161
Other vendor posts:
* https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-...
* https://research.jfrog.com/post/arrayref-proc-macro1-crates-...
* https://www.aikido.dev/blog/two-popular-rust-crates-arrayref...
Re: Malicious Rust crate Arrayref runs a build-time payload
#9Rust seems barely better than Node in this regard. Go or .Net or anything with a robust standard library seems like the way to go for most projects.
Re: Malicious Rust crate Arrayref runs a build-time payload
#10Why this still happens? Why after many previous supply-chain attacks maintainers of package repositories still allow anyone uploading packages and pushing updates without security audit?
Who is funding this security audit? Are folks supposed to volunteer their free time? It's a difficult coordination problem. The best folks have come up is to delay adopting new releases by a few days and hope your dependency is popular enough that a security firm audits it for you in that timespan. If you have enough money I suppose you can start employing llms to audit things for yourself.