April 10, 2026

Crates, crooks, and comment wars

Supply chain nightmare: How Rust will be attacked and what we can do to mitigate

Rust community splits: 17% 'mystery code' freakout vs 'vendor it and relax'

TLDR: A blog warns Rust’s code supply chain is a soft target, citing a stat that 17% of top packages don’t match their public code. Comments split between bunker-mode (“vendor everything”), calm rebuttals (“overstated”), and practical fixes (pin, review, sandbox), with jokes flying as trust takes center stage.

Rust world just got a jump scare: a popular blog warns attackers will target Rust’s central code hub (think “app store for code”) and waves a stat that 17% of top packages don’t match their public code. Translation for normals: some downloads don’t match what’s in the shop window, and people are loudly Not Okay.

Cue the comment cage match. One camp went full doomsday-prepper: “Vendor your dependencies” (aka copy everything in-house and lock the doors), with fans saying this is the only way to sleep at night. Another camp, led by skeptics like woodruffw, called the 17% headline overhyped, saying most mismatches are boring packaging quirks, not spy movies. Meanwhile, the practical crowd marched in with clipboards: pin your versions, get multiple reviewers to sign releases, and maybe even sandbox each add‑on so a bad apple can’t take the whole pie.

The drama got spicier with the author’s airline-safety rant: pilots treat incidents like life-and-death, so why doesn’t software? Some nodded; others rolled eyes. And of course, the memes landed: one commenter cracked that Rust can’t have a “buffet overflow,” poking fun at Rust’s memory-safety rep while the real fear is tampered updates. Bottom line: trust is the bug—and the fix depends on whether you’re a bunker-builder or a belt-and-suspenders realist. Read the room, and your lockfile.

Key Points

  • Rust’s ecosystem relies on a centralized registry (crates.io) and extensive third-party dependencies, creating supply chain risk similar to JavaScript.
  • Recent package compromises in ecosystems like JavaScript (e.g., axios) illustrate the scale and impact of supply chain attacks.
  • An analysis by Adam Harvey found that about 17% of the 999 most popular crates on crates.io do not match their source repositories.
  • Attackers can use the crates.io API to quickly identify high-download targets and then pursue maintainers via platforms like GitHub.
  • Threat actors may gain initial access through phishing or by purchasing compromised cookies or credentials.

Hottest takes

"Vendor your dependencies." — lesuorac
"this is essentially overstated" — woodruffw
"But it's impossible to have a buffet overflow in rust" — bcjdjsndon
Made with <3 by @siedrix and @shesho from CDMX. Powered by Forge&Hive.