Supply chain attack on arrayref
https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref?=0Open linkView original on europe.pubSyndicated from the fediverse. Read and engage on the original instance.
View original on europe.pubhttps://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref?=0Open linkView original on europe.pub
5 replies
Guess it was just a matter of time.
Reminder to have minimum ages for update releases to help avoid these exact kinds of attacks. I do like 3 days which is probably overkill.
How do you set that up?
I'm not a rust user but it looks like the feature is in their unstable branch https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#min-publish-ag. Also looks like someone made a crate to do that called cargo-cooldown. These supply chain attacks have been more frequent only recently so a lot of ecosystems are still working on implementing this kind of feature.
Configure your updater and use exact or semi-exact versions.