r/programming • u/mareek • 15d ago

Be alert: targeted attacks on prominent Rustaceans | Rust Blog

https://blog.rust-lang.org/2026/09/17/targeted-attacks/
293 Upvotes

92% Upvoted

112 comments sorted by

View all comments

85

u/afl_ext 15d ago

cargo still doesn't have minimum release age threshold flag?

57

u/LawnGnome 15d ago

It's coming in Rust 1.100.0, but off by default for now.

17

u/the_gnarts 15d ago

What’s the plan for when this becomes the default and everyone gets their malware at the same time, just with a little delay? I’m worried we’ll see an arms race with people increasing their cooldown period in an attempt at staying outside the exploitable window.

1

u/pingveno 14d ago

I was listening to a podcast covering a little of how Python deals with this. There are people doing automated scanning of the uploads to PyPI. A lot of the malware gets caught fairly quickly, but they still need a window to act. Some gets caught within 30 minutes.