Top
Best
New

Posted by abhisek 8 hours ago

Malicious Rust crate Arrayref runs a build-time payload(safedep.io)
https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on...

https://github.com/rustsec/advisory-db/issues/3161

331 points | 308 commentspage 3
xdavidliu 4 hours ago|
> The genuine arrayref and append-only-vec crates are maintained by droundy, whose account appears to have been compromised.

That name looked familiar to me; I believe it's the same David Roundy who was an academic at Reed College who wrote DARCS, which is version control software. I used DARCS when I started grad school around 2010 before switching to git.

demibabs 8 hours ago||
What does the malicious code actually do?
hmry 6 hours ago||
I would like to know too, but the author's Github account seems to have been deleted, and the crates.io releases have been completely deleted too (not just yanked) so it seems impossible to view the file :/
FartyMcFarter 7 hours ago||
Yeah I scanned the article and I couldn't find this either.
aselimov3 7 hours ago||
Rust finally got hit... This was motivating me to swap away from Rust towards because of the huge number of dependencies. It seemed inevitable. Ginger bill was right, https://www.gingerbill.org/article/2025/09/08/package-manage...
jooops1 6 hours ago||
The author proposes to reinvent the wheel and depend on stale dependencies, which are EOL. Neither of that is an acceptable solution with LLM-based Agents being able to produce exploit(ExploitGym) chains in minutes from known bugs. The other issue is that Rust's forces the user to provide more information and APIs are usually kept generic for systems programmer, so standardizing things is not as straight-forward compared to Go where you can assume a memory-management, a virtual thread runtime and mostly ignore dynamic dispatching.
aselimov3 3 hours ago||
I don't think anyone is saying that you should depend on stale dependencies. You should not hand off your responsiblity to untrustworthy package managements services though. Evidence of the failure of automated package management is the near constant shai-hulud attacks as well as the originating post here.

The fact is that your dependencies are your responsibility. You should be staying up to date on what you depend on and their vulnerabilities. Most vulnerabilities affect specific code paths which may not be present in your code base and do not require mitigation. These are decisions you can make by understanding what your dependencies are instead of offloading to automated package management systems.

NPM has been the posterchild of these types of issues but the dependency stack I saw everytime I compiled even simple programs in Rust made me think Rust would be impacted next. Personally I think third party modules that are effectively universally used (axum, tokio, serde) should be integrated directly into the language.

Ygg2 7 hours ago||
Honestly, Ginger Bill is plain wrong.

Just because you don't develop a package manager for your language, doesn't mean someone else won't. See NPM.

aselimov3 3 hours ago|||
Well I think the main important argument here is you shouldn't use the package management. A third party package manager would be even more concerning to use imo. I generally try to stay away from the typescript world so unfamiliar with nuances of NPM.
beanjuiceII 6 hours ago|||
yep which people have already done in odin
never_inline 6 hours ago||
I am surprised this took so long.
aftbit 8 hours ago||
Why do none of these hijacks embed runtime attacks? It seems like worming the build machines is the goal, rather than compromising downstream users.

It seems like we should be building and testing everything in bubblewrap or some other sandbox going forward.

Retr0id 8 hours ago||
It usually takes some time for an updated dependency to actually get shipped to users in a release, by which time there's a good chance the attack has been noticed.
crote 8 hours ago|||
> Why do none of these hijacks embed runtime attacks? It seems like worming the build machines is the goal, rather than compromising downstream users.

Developer machines are quite juicy targets. They tend to have all sorts of credentials lying around, so it often isn't too difficult to escalate from that to compromising AWS/GCP/etc.

On top of that there's very little preventing a compromise. Developers are inherently expected to run untrusted code, and the usual Linux / MacOS laptop probably isn't even running any kind of anti-virus protection. Want to compromise the downstream app? Now you also need to pass Play Protect & friends.

> It seems like we should be building and testing everything in bubblewrap or some other sandbox going forward.

Yes, we really should. It is frankly a miracle that it has taken so long for fetch-time / install-time code execution to start blowing up in our faces. If we are spending so much effort on run-time isolation, why are we completely ignoring all those practices during development?

ptx 6 hours ago||
Why are developers "inherently expected to run untrusted code"? Running untrusted code on developer machines seems like a terrible idea, given that it will compromise everything they build or deploy and (as you mentioned) all their credentials.
brazukadev 37 minutes ago||
because cloning repos and installing dependencies is what developers do daily. 90% of more don't care or even know that doing so they are risking getting hacked.
never_inline 6 hours ago||
How do we know they don't? Who is going to read the source for all these micro packages?

You might assume we are able to detect all malicious behavior at runtime. But "stuxnet" and more recently, the xz compromise say otherwise. What if a not-so-popular crate deep in the dependency chain subtly introduced a LPE in it's code?

hsaliak 6 hours ago||
At least it’s safe
dematz 7 hours ago||
Jumping off the title and ignoring contents of post, as is customary: look at this graph and guess which languages use each number of dependencies for their website: https://www.youtube.com/watch?v=E82ly38YEEQ&t=325s

I won't spoil the claim in the video about what the dependency number is correlated with, and I'm not even sure how true it is in general, but it's very interesting.

vlovich123 8 hours ago||
I’m disappointed crates.io doesn’t have a stricter bar for serving a crate that has newly acquired a proc macro or build.rs. That seems like a trivial mitigation.
weinzierl 8 hours ago||
Mitigation for what?

Compromising the code that is then most likely run in a test instead of compromising a build script is just a very slight inconvenience for the attacker.

I'm not particularly fond of arbitrary build scripts either, but restricting them will not help the supply chain issue in a significant way.

Also there are several ways to control build.rs execution in the Cargo ecosystem, for example with cargo-deny.

vlovich123 7 hours ago||
Defaults matter. It’s nice you can set this up using a plugin to protect yourself, but that doesn’t protect the ecosystem, most of which doesn’t use cargo deny.

I also disagree a build scripts is a mild convenience. A build script always runs for anyone it’s a dependency for with full access and context and often has access to secrets in CI. A compromised runtime has more limited access and requires actual invocation of code paths (if you’re lying as a dependency that’s never executed, no exploit).

Of course Rust should have language-level support for capabilities so that just invoking a function doesn’t grant it access to arbitrary disk access. But that’s a much more difficult change than tweaking the defaults for cargo.

praseodym 8 hours ago||
As mentioned by others it’s just as easy for an attacker to modify a crate’s runtime code.
vlovich123 7 hours ago||
So? Runtime code requires actually executing the malicious code path which isn’t an immediate 100% hit rate for everyone that includes it in the dependency chain. For build.rs it’s a 100% compromise of everyone it’s in the dependency chain for. Additionally, at runtime you may not have access to secrets whereas at build time you most certainly do.
dgrunwald 3 hours ago||
The malicious code could use life-before-main hacks to gain code execution if it's linked at all, even if uncalled. https://grack.com/blog/2026/06/11/life-before-main/
vlovich123 3 hours ago||
It doesn’t take away from the point that build time often has access to secrets the runtime does not.
somerandomness 2 hours ago||
wow, what did payload do?
FartyMcFarter 6 hours ago|
This is quite the egg on the face, given that Rust proponents keep telling us how it's great for writing secure software.
More comments...