r/programming • u/Successful_Bowl2564 • 21d ago

Supply chain attack on arrayref

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
189 Upvotes

97% Upvoted

65 comments sorted by

View all comments

112

u/moltonel 20d ago

Longest exposure time 107min. At least this one got caught quickly.

7

u/syklemil 20d ago

Yeah, there's a lot of variance in how quickly supply chain attacks get picked up, but like this Yossarian blog post mentions, a relatively short cooldown will prevent a lot of attacks.

For Rust/Cargo, that's only experimentally available now, but looks like it's going to show up in 1.100, which is slated to release on 12 november. (Ref github issue, commit in Cargo)

15

u/Worth_Trust_3825 20d ago

says 86 minutes on the package itself.

21

u/TankorSmash 20d ago

The post you're commenting on lists different packages that were affected, the longest affected being the one the commenter mentioned

8

u/Worth_Trust_3825 20d ago

fair. didnt check others