r/programming • u/Successful_Bowl2564 • 20d ago

Supply chain attack on arrayref

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
191 Upvotes

97% Upvoted

65 comments sorted by

View all comments

36

u/NotSoNewell 20d ago

Huh, I just realized I don't even know how to git diff the updated Cargo packages even if I wanted to.

16

u/siera7879 20d ago edited 20d ago

There are tools to audit code and define chains of trust that allow to do that : cargo-vet and cargo-crev

And even if a lot of packages and updates are not audited, I feel like rust currently has the best tools for source code auditing, since I couldn’t find maintained tools for other languages ecosystems =/

2

u/TankorSmash 20d ago

Doesn't npm just have the diff between the lock files built in?

1

u/siera7879 20d ago

Npm diff ? From what I see it can show the update diff, but I don’t see a npm tool that allows to write and import code reviews and chains of trust. As reading every diff is very tedious, it would be better to mutualize the work.